What our analysis found

Hockey Shootout is rated caution by Extension Auditor. Our code review reported 3 findings (1 high, 2 medium), led by privilege escalation. It comes from a publisher with 28 extensions and was last updated in April 2026.

Key findings

• high· privilege escalation —externally_connectable is opened to <all_urls>, meaning any web page on the internet may call chrome.runtime.sendMessage into this extension, yet no file in the complete 311-file package registers chrome.runtime.onMessageExternal or onConnectExternal (verified by grep across,,, and every other script). A hockey mini-game that never accepts external messages has no reason to declare the broadest possible caller surface. Paired with the host permission, which is likewise referenced nowhere in the codebase, this is unused privileged capability staged in the manifest that a future silent update could activate without any new permission prompt.
• medium· phishing —The JSON fields protxt and rating returned by are assigned straight to innerHTML inside the privileged chrome-extension:// origin, with no sanitisation and no schema constraint. The server therefore fully controls arbitrary markup rendered on the extension's own page, which can be swapped at any time into a credential-harvesting form, a fake browser or Google prompt, or an off-site link that inherits the trust users place in an installed extension. The extension_pages CSP (script-src 'self') blocks inline script execution, so this is not remote code execution, but it is an operator-controlled UI surface that is served from a domain the IoC feed lists as a shared C2.
• medium· other —The game page embeds a hidden, high z-index banner whose image and click destination both point at multiaccount.cloudapi.stream, an operator-controlled host on the same domain the IoC feed flags as the campaign C2. Because both the artwork and the link target are fetched remotely, the publisher can repoint this slot at any landing page after installation without shipping an extension update, and the remote image fetch also leaks a per-session beacon. Nothing in ever reveals this element, so it is dormant content the operator can enable server-side.

The game itself is clean, unmodified Arcade code: (518 KB) is TweenJS plus the stock Hockey Shootout engine with zero network calls and zero chrome.* API use, is stock, and is a plain string table, so the ML regex hits (js_innerhtml 37, js_appendchild 51, 1.97 MB of JS) are game-engine code and vendored libraries, not malice. What contradicts a clean verdict is the thin wrapper the publisher added around it::17 declares externally_connectable for <all_urls> while no file in the full 311-file package registers onMessageExternal or onConnectExternal,:30 requests which is never referenced anywhere, and:43-47 renders server-controlled HTML from mines.cloudapi.stream directly into the extension origin. The IoC note tying cloudapi.stream to the Socket 108-extension shared-C2 campaign and the publisher's malicious rate corroborate the ML score as context, but I found no code path in this version giving that C2 access to cookies, identity, browsing history or page content (there are no content scripts and permissions is empty), so I stop at suspicious rather than likely_malicious.