Our paper investigates behavioural trends with users and extensions across three popular web browsers: Google Chrome, Microsoft Edge, and Mozilla Firefox, and explores the viability of comparing file hashes to identify potentially malicious extensions in each web store. We created a cross-sectional dataset for analysis of extension ecosystems by developing Python-based web crawlers for each of the web stores and used a dataset of known malicious extensions to compare it to. The analysis of our results shows that there is significant overlap in commonly used JavaScript libraries across browsers. Here, Edge stands out, with 12.49% of extensions sharing at least one hash with an extension in the dataset of known malicious extensions. This suggests a practical approach for cross-platform detection of possibly malicious extensions with file analysis.