The extension does exactly what it advertises::1472 registers chrome.webRequest.onResponseStarted over <all_urls> purely to sniff GET responses whose content-type is / x-mpegURL / dash+xml / MPD, collects them per tab, and:12634 and:13261 turn a user click into a link to the publisher's own [domain withheld]... — there is no telemetry, no analytics SDK, no third-party host, no access, and no dynamic code loading anywhere in the bundle (grep -c 'eval(' is 0 in all three JS files; the single `new Function("return this")` at:361 is the webpack globalThis shim, and the 29 fromCharCode hits are the bundled whatwg-fetch polyfill at:). What stops me short of clearing it is a genuine, exploitable design flaw rather than any malice::1331 accepts an "EXTENSION_INIT" postMessage with a MessagePort and no check, and the scope it hands that port (:1261-1270) exposes remoteFetch({url, options}) and the chunked `mf` reader, which:1545 forwards verbatim to a service-worker fetch backed by [domain withheld] + [domain withheld] host permissions with no URL allowlist and no forced credentials:'omit' (request default is 'same-origin',:833, so a caller passing credentials:'include' gets a credentialed cross-origin read).: the ML score, the permhash cluster (size 1 — it is this extension's own prior label, circular) and the chrome-stats score all just restate the webRequest+<all_urls> manifest and none of them touched this bridge; publisher reputation (single extension, valid contact, trusted-extension badge) and the feedback (users complaining downloads break) both point benign. Also note the bundled 1.23.0 manifest omits the "storage" permission present in the live CWS manifest — a subset, not an escalation, but it means the reviewed ZIP may not be byte-identical to what is shipping, which is part of why confidence is medium.