What our analysis found

ClassLink OneClick Extension, used by 14,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites and can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

ClassLink OneClick is a legitimate educational SSO browser extension with 15M users and a Google trusted publisher badge. All analytics POST requests go to (ClassLink's own first-party analytics domain), and the data sent (appid, gwstoken, time-spent) aligns precisely with CWS-disclosed 'Web history' collection. The AES-encrypted credential handling in decrypts server-provided credentials using CryptoJS (a standard library bundled as) solely to automate login form-filling on institutional app websites — consistent with the extension's stated SSO purpose. The ML score of 0.00 corroborates the benign verdict; the risk-engine score is driven by permission breadth, which is inherent to any SSO extension that must operate across arbitrary school app websites. The only non-trivial pattern is the execute-script handler in (line 1070–1080) that injects server-supplied into pages in MAIN world — however, these scripts originate exclusively from *. SSO response pages and follow a standard pattern used by all major SSO extensions (Okta, OneLogin, etc.).