What our analysis found

IntoWords Cloud, used by 200,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites. It comes from a trusted publisher and was last updated in September 2026.

The provided source code (8 files) shows only benign HTML templates, a manifest with permissions typical of an accessibility extension, and a small Google Docs injection script. No malicious code is present in the examined files. The broad permissions (clipboard, downloads, tabs, webNavigation, all_urls) are consistent with the extension's stated purpose of providing text-to-speech, speech-to-text, and support across all websites. The CWS-disclosed data collection includes 'User activity', which aligns with expected telemetry to the publisher's own domains (,). While another extension by this publisher is flagged as malicious, that alone does not incriminate this extension without supporting code evidence. The ML model and risk-engine concerns are likely driven by the permission set and typical patterns in minified bundles, which are not present in the reviewed snippets.