What our analysis found

Cite This For Me: Web Citer, used by 700,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by other. Its permissions mean it can read and change data on all websites and can inject scripts into pages.

Key findings

• high· other —The bundled manifest declares manifest_version 2 and permissions [" ", "tabs", "storage", "*://*/*"], but the live CWS listing for the same version (2.6.11) shows manifest_version 3 and permissions ["tabs", "storage", "scripting"] with host_permissions ["*://*/*"]. Additionally, web_accessible_resources differ. This discrepancy may indicate an outdated submission or a mismatch between the reviewed source and the current extension on the store, potentially leading to version confusion or abuse.

The extension's behavior is fully explained by its stated purpose of generating website citations. All data sent (URL, citation style, optionally highlighted text) goes to the publisher's own domain () and is necessary for citation creation. The manifest mismatch between the bundled code and the published listing is a hygiene issue but not malicious. The ML model likely overfitted on broad host permissions and MV2, both common in benign extensions of this type.