What our analysis found

Mouse Gesture Events, used by 100,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by other. Its permissions mean it can read and change data on all websites and can inject scripts into pages.

Key findings

• high· other —The bundled manifest declares version 2, but the published Chrome Web Store listing shows manifest_version 3 with permissions 'scripting' and host_permissions instead. This discrepancy could indicate that the version under review differs from the live extension, though no malicious code was found in the provided source.

The extension's code is minimal and transparent: it performs mouse gesture detection to trigger browser actions (new tab, close tab, etc.) exactly as advertised. All data processing is local; there are no network requests, no external analytics, and no data exfiltration. The required permissions (<all_urls>, sessions, storage) are essential for gesture detection on any page, tab management, and settings persistence. The ML model's signals (data URIs, SVG construction, etc.) are benign—they originate from the options page's icons and the settings export feature. The publisher is reputable, with no other malicious extensions. The sole discrepancy is a manifest version mismatch between the bundled code (v2) and the published listing (v3), but this does not indicate malicious intent.