This extension declares zero permissions (confirmed in both bundled and published manifests — no mismatch) and implements a simple bubble-shooter game popup. The sole JS behaviors are: opening [domain withheld] on install (:13), setting a CWS reviews link (:1-2), toggling fullscreen, and injecting an iframe pointing to a hardcoded `[domain withheld] URL when the user clicks 'Play Now' (:37-38). The `js_innerhtml` hits that drove the ML score map entirely to this single hardcoded iframe injection in the extension's own popup — no web page content is touched, no data is collected or exfiltrated, and no external execution occurs. Third-party signals corroborate: chrome-stats Impact, publisher has Google's trusted-publisher badge, and publisher-level malicious rate is 1% ( other extensions), all contradicting the ML's medium flag.