Internships by Chegg: Job Autofill Chrome extension security report

Internships by Chegg helps students land internships without the copy-paste grind. Open a job posting on Greenhouse, Lever, Ashby, Workday, or LinkedIn Jobs and Chegg wakes up in a side panel: it recognizes the role, pulls the parts of the job description Chegg needs, and offers a résumé and cover letter tailored to that posting in seconds. Click into the application form and Chegg fills in the parts you've answered before — name, school, major, work authorization, the saved answers from your Chegg profile — so you can spend your time on the parts that actually matter. **What Chegg does on a job page** - Detects the role and pulls the job description into a tailored résumé and cover letter. - Surfaces a "Chegg's read" so you can verify the role match before generating materials. - Fills repeatable form fields from your saved Chegg profile. - Refuses sensitive-demographic fields (race, gender, disability, veteran status) and surfaces them for you to answer manually. - Tracks your application end-to-end in your Chegg dashboard. **What Chegg never does** - Reads pages outside the supported job sites (long-tail sites are opt-in per origin and revocable from the options page). - Sends page HTML, scripts, or screenshots to Chegg's servers. - Sends the free-form answers you type into application forms. - Sells your data. **Supported sites at launch** - Greenhouse postings and applications - Lever postings and applications - Ashby postings and applications - Workday postings and applications (both myworkdayjobs.com career sites and workday.com custom domains) - LinkedIn Jobs postings (copy résumé/cover letter to clipboard for LinkedIn's own application flow) Other origins can be enabled one at a time from the extension's options page; nothing reads those pages until you grant explicit consent, and consent is revocable at any time. **Privacy posture** Chegg only reads job-description text from the supported sites listed above, transmits it as plain text (never HTML, never markup), and ties the tailored materials to your Chegg account. Form-field values come exclusively from the saved profile you control through the Chegg dashboard. Full privacy policy: https://www.chegg.com/privacypolicy **Beta status** The Chegg extension is in beta. If something feels off, email `internships-ext-feedback@chegg.com` and the team will respond. **Permissions justification** - `storage` — keeps your encrypted Chegg sign-in token in `chrome.storage.local` between visits. - `identity` — used once at sign-in for `chrome.identity.launchWebAuthFlow` against the Chegg auth server. - `scripting` — injects the Chegg content script into a long-tail site you have explicitly opted into (Tier-1 sites are injected statically and need no extra grant). - `activeTab` — on a toolbar click, reads only the active tab's URL so Chegg can request that one origin's opt-in permission, without the broad `tabs` permission. - Tier-1 host access (Greenhouse, Lever, Ashby, Workday, LinkedIn Jobs) — required for Chegg to detect the role on the page you opened. - Optional host permissions (any HTTPS site) — never requested without an explicit per-origin opt-in from the options page. Made by Chegg, Inc.