Line Numbers for Google Docs

The bundled manifest declares `notifications` and the narrower `https://linenumbers.app/api/v1/*` scope, whereas the published CWS manifest omits `notifications` and grants the broader `https://linenumbers.app/*`. The `notifications` permission is exercised by Firebase Cloud Messaging for subscription-update alerts, which is legitimate, but the divergence between the installed and store-listed manifest means users could not have consented to the `notifications` permission from the store listing. This is a minor transparency/disclosure discrepancy, not evidence of malice.

{  "permissions": [    "https://docs.google.com/document/d/*",    "https://linenumbers.app/api/v1/*",    "storage",    "notifications"  ]}

GTM container GTM-KVTFCZ4 is loaded by dynamically injecting a script element into the background page. While this is standard analytics practice and the manifest CSP explicitly permits https://www.googletagmanager.com, it means whoever controls this GTM container could push arbitrary JavaScript into the extension background context. This runs only in the background page (not injected into Google Docs), the CSP was intentionally permissive for it, and GTM is consistent with the publisher's analytics needs for a subscription product — but it is technically a remote-code-loading vector of note.

(function(w, d, s, l, i) {  w[l] = w[l] || [];  w[l].push({    'gtm.start': new Date()      .getTime(),    event: 'gtm.js'  });  var f = d.getElementsByTagName(s)[0],    j = d.createElement(s),    dl = l != 'dataLayer' ? '&l=' + l : '';  j.async = true;  j.src =    'https://www.googletagmanager.com/gtm.js?id=' + i + dl;  f.parentNode.insertBefore(j, f);})(window, document, 'script', 'dataLayer', 'GTM-KVTFCZ4');