Kreeder is exactly what its listing claims: an RSVP speed reader for [domain withheld]. The content script () only clicks Kindle's own chevrons and canvas-copies the already-rendered page image, is a pure two-port relay between that content script and the popup window, and runs the page image through a locally bundled worker (chrome.runtime.getURL(' '),:622-626) and paints words into its own popup. A case-sensitive grep across every first-party JS file for?:// returned zero outbound requests and zero dynamic code evaluation — the only hits were `new Image()`/`img.src = imageDataUrl` on the extension's own data: URL inside the column-split OCR helpers (:669, 778, 812, 859). Settings persist via chrome.storage.sync only. The corroborating signals are weak: the permhash cluster (activeTab+storage+tabs, 9% malware) is the single most generic MV3 permission triple in the store; 'publisher flagged malicious' is circular here because this is the publisher's only extension, so leave-one-out aggregates over an empty set; and chrome-stats' top likelihood reason is 'removed-from-store' while the record under review is status=active. The bundled MV3 manifest also narrows surface versus the published MV2 summary (no externally_connectable, no longer web-accessible), with identical permissions and no host_permissions on either side, so there is no privilege-escalating mismatch to report.