The extension implements standard cashback affiliate redirect functionality: it fetches a shop rules list from [domain withheld], applies declarativeNetRequest redirect rules to route users through affiliate links, and renders a React-based notification banner. All network traffic ( fetch, user_settings sync, avatar image loads) goes to publisher-controlled subdomains of [domain withheld]. No data is sent to unrelated third parties. The ML model independently gave a score of 0.00 (low), directly contradicting the permission-based Critical risk-engine rating; the Critical rating is explained entirely by the broad permissions necessary for a cashback extension (webRequest, declarativeNetRequest, cookies, all-URLs host_permissions) — all of which are needed for the redirect interception mechanism. The permhash cluster is clean (0 of 7 flagged as malware). Minor privacy note: the content script sends btoa(document.referrer) as part of the cashback notification image URL ( line 7637-7654), but this goes to the publisher's own [domain withheld] and falls within first-party data collection; it is not reported as a finding under the verdict rules.