What our analysis found

Email Hunter, used by 200,000 people, is rated caution by Extension Auditor. Our code review reported 5 findings (2 critical, 3 high), led by data exfiltration. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests.

Key findings

• Critical

  Data Exfiltration

  The file named, presented to users as the free 'Safe Checker' feature, is really a clickstream panel client: it is initialised in mode FULL_NAVIGATION against the third-party host [domain withheld] carrying distributorId and partnerId 391 plus a panel instance id, which are revenue-share identifiers for reselling a panellist's browsing stream rather than parameters of a URL-reputation lookup. The destination is neither the publisher's own domain (both the publisher website and the privacy policy are a Google Doc) nor a recognised SaaS that an email-extraction tool in Workflow & Planning would justify, and [domain withheld] is named nowhere in the listing, the options page or the popup. The verdict is the pretext under which a complete navigation record is shipped on every page load.

  Show more — Data Exfiltration
• Critical

  Unauthorized Data Collection

  This is the record actually uploaded per navigation, and its breadth cannot be explained by a URL-safety check: alongside the full URL it carries the page title, window.name and document.referrer scraped from the tab via chrome.scripting.executeScript (ScriptManager.getPageData, -1030), the originating tab and frame ids, the navigation sequence, OS and browser versions, the resolved server IP, and the complete header list of every document navigation in both directions, since mapHeaders () copies each pair through with no allowlist. What counts as sensitive and gets masked is not decided locally either: SensitiveDataFilter.updateRules ( -2775) downloads the redaction ruleset from the same vendor at [domain withheld] every 12 hours, so the recipient of the data unilaterally controls how much of it is retained.

  Show more — Unauthorized Data Collection
• High

  Tracking

  The 'panalyticsid' panellist identifier is deliberately replicated into three independent restore channels on [domain withheld]. globalSetter () writes it to localStorage, then to the HTTP cache via cacheSetter (), which smuggles the value in an X-PANEL-USER-KEY request header so it can later be recovered from a cached response, then to this credentialed third-party cookie; loadKey () reads them back cache first, cookie second, storage last. Restoring an identifier out of the browser cache has no functional role in a safety lookup and exists to make the id survive the user clearing extension storage or reinstalling, which is fingerprint-style tracking resilience and is outside both the CWS-disclosed categories and anything the consent screen mentions.

  Show more — Tracking
• High

  Other

  The reviewed package requests 'tabs' and 'declarativeNetRequest', neither of which appears in the live CWS published-manifest summary. Checking our stored CRX history shows this is version drift rather than a hidden-privilege discrepancy, since 1.47 and 1.48 request exactly the six permissions the listing reports, so the live listing describes a later build than the 1.34 under review. The drift matters because declarativeNetRequest is referenced by no file in extract_dir, and in the full 1.34 CRX its only consumer is the bundled Mellowtel 1.3.4 crawler in, which while a crawl is running installs a session rule removing x-frame-options, content-security-policy and Frame-Options from every sub_frame response matching '*://*/*' so that arbitrary URLs pushed over [domain withheld] can be framed and scraped from the user's browser and IP, with the extracted HTML, markdown or text returned to the operator's AWS lambda endpoints. That is a browser-security downgrade no email-extraction feature needs, and it contradicts the extension's own claim that the library 'shares your bandwidth only' and that 'Security and privacy are 100% guaranteed'.

  Show more — Other
• High

  Unauthorized Data Collection

  The consent screen that gates the whole product misstates what it is consenting to. It says 'We do not collect any personal data' and frames the request as permission to 'read' browsing, while the toggle it controls (:117-122, which writes userAgreedV2 and messages enableSafeBrowsing) is what switches on the FULL_NAVIGATION clickstream that ships every URL with its query string, page title and full navigation headers to a third-party panel broker; the adjacent block claims Mellowtel 'doesn't collect, share, or sell personal information (not even anonymized data)' while that library frames and uploads arbitrary third-party pages from the user's machine. Both switches ship pre-checked and:1527-1535 hides the email tool entirely until consent is recorded, with no decline path, so the disclosure that would otherwise make this collection legitimate is both coerced and inaccurate.

  Show more — Unauthorized Data Collection