What our analysis found

Device Recovery Utility, used by 2,000,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 medium), led by other. It comes from a trusted publisher and was last updated in October 2026.

Key findings

• medium· other —The bundled manifest uses manifest_version 2 and includes 'activeTab' and the host ' '. The live CWS manifest summary shows manifest_version 3, removes 'activeTab', and uses 'host_permissions' with ' ' and ' '. This mismatch indicates either an outdated analyzed version or an intentional update; not inherently malicious but notable.

The extension is a first-party Google tool for Chromebook recovery. All network communication is to Google-owned domains (,) and is consistent with the publisher's privacy policy. No evidence of data exfiltration, code injection, or malicious behavior. The bundled manifest differs from the published CWS manifest, but this likely reflects an update; the core functionality remains benign. The ML model likely over-fitted on standard library code patterns.