What our analysis found

EasyBib Toolbar, used by 700,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by other. Its permissions mean it can read and change data on all websites.

Key findings

• high· other —The bundled manifest declares manifest_version 2 with permissions ' ', ' ', 'tabs', and 'webRequest'. The published CWS listing (live manifest summary) shows manifest_version 3 with host_permissions '*://*/*', permissions ['tabs', 'storage'], and no webRequest. This discrepancy may mislead users about the actual extension capabilities, particularly the webRequest permission that allows monitoring all web traffic. The extension does not use webRequest broadly, but the mismatch is a red flag for potential covert permission escalation.

The extension code performs citation and credibility checking on, sending necessary data to first-party endpoints. The only concern is a mismatch between the bundled manifest (v2, with webRequest and all_urls) and the published CWS summary (v3, with storage and reduced host permissions). This could indicate a deceptive permissions upgrade or version mismatch, but the code itself does not exhibit malicious behavior. The ML model likely flagged webRequest and large JS size (libraries) as suspicious, but they are justified.