Marvis is a CDP-based browser automation bridge published by Tencent. The service worker () implements a complete set of Chrome DevTools Protocol commands (Ext.click, Ext.fill, Ext.evaluate, Ext.cookies, Ext.screenshot, etc.) that are dispatched exclusively to and from a locally-installed native host application via chrome.runtime.connectNative('com.marvis.extension'). There is zero outbound network communication to any remote server — all data flows through the nativeMessaging pipe to a process on the user's own machine. The debugger permission is used architecturally to relay CDP commands from the local agent host into the browser, which is the standard pattern for tools like Playwright or Puppeteer extension modes. The ML model overfit on the combination of `debugger` + `nativeMessaging` + large JS file with CDP API patterns, all of which are signatures of a legitimate automation bridge rather than malware; the third-party score's risk factors (new extension, low users) corroborate recency, not malice.