What our analysis found

Link Grabber, used by 200,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 medium), led by other. Its permissions mean it can inject scripts into pages.

Key findings

• medium· other —The bundled manifest (manifest_version 2, permissions: activeTab, clipboardWrite, contextMenus, storage) does not match the published CWS manifest, which is version 3 and includes an additional 'scripting' permission. This discrepancy indicates that the live extension may have been updated with different capabilities after this version. While the analyzed code shows no malicious behavior, the mismatch is a potential security concern.

The extension extracts links from the current page and displays them—exactly as described. No external network requests, no remote script loading, and no user data is exfiltrated. The low ML score (0.13) aligns with the code, while the risk-engine’s high score is driven by over-cautious flags on clipboardWrite (used legitimately to copy links) and an old manifest version. The only irregularity is a manifest mismatch: the live CWS listing shows manifest v3 with an extra 'scripting' permission, absent in the bundled v2. This suggests a post-review update, but nothing in the provided code is malicious.