The extension is a Brawl Stars fan popup with virtual currency mechanics, box-opening simulation, and cross-device save sync. All network traffic goes to declared host_permissions: the extension's own Supabase instance ([domain withheld], used for game-state sync only — trophies, virtual, brawler unlocks) and legitimate Brawl Stars third-party APIs (brawlify, royaleapi proxy, [domain withheld]). The ML score was inflated by heavy UI rendering inside the extension's own popup ( for brawler cards, reward overlays), POST requests to the extension's own declared Supabase edge functions, and minification artifacts. There is a manifest delta — the bundled ZIP includes [domain withheld] (not in the published manifest) while the published listing adds many additional domains (Wikipedia, GitHub, allorigins.win, etc.) not present in the bundled ZIP — but given the extension's code shows no active misuse of any of these permissions and the overall behavior is consistent with its stated purpose, this mismatch is consistent with a beta developer iterating on scope rather than a backdoor.