What our analysis found

Eneba - Seamless Keys Activation and Cheap Games Offers, used by 700,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 low), led by unauthorized data collection. Its permissions mean it can read and change data on all websites and can inject scripts into pages.

Key findings

• low· unauthorized data collection —The extension sends usage analytics events (e.g., 'Viewed Extension UI') to the publisher's backend (). The Chrome Web Store listing declares no data collection, which is a compliance mismatch. The events contain only extension usage data and no personally identifiable information, but they should be disclosed in the privacy disclosure according to CWS policy.

The extension is a legitimate game key activator for Eneba, using broad necessary to inject activation UIs into Steam, Microsoft, and Instant Gaming pages. All network communication is first-party to. The ML model's high-risk score is a false positive driven by broad permissions and content script injection, which are core to the extension's function. The only issue found is minor: the extension sends usage analytics events (e.g., 'Viewed Extension UI') to the publisher's domain without disclosing data collection in the CWS listing. This does not involve personal data and is a compliance oversight, not malicious intent.