What our analysis found

OneGlass, used by 1,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by network interception. Its permissions mean it can read and change data on all websites and can observe network requests.

Key findings

• high· network interception —The extension unconditionally strips Content-Security-Policy and X-Frame-Options response headers from every URL the browser visits, not just the extension's own CRM target domains. CSP prevents XSS exploitation on banking, healthcare, and other sensitive sites; X-Frame-Options prevents clickjacking. While the architectural motivation is to allow the OneGlass app to be embedded as an iframe inside CRM portals, applying the filter to <all_urls> rather than the declared CRM host patterns degrades browser-level security for all other sites the user opens during an active browser session.

This is a legitimate enterprise sales tool by Accenture (publisher email thomas.lamb@) for CRM integration across Salesforce, Dynamics, HubSpot, and other platforms. All data endpoints resolve to subdomains or known enterprise CRM SaaS providers; no covert exfiltration was found. The elevated ML score is driven by legitimate enterprise features: SignalR WebSocket connections, multiple OAuth flows (MSAL, RingCentral), webRequestBlocking for header manipulation to enable iframe embedding across CRM domains, and a large multi-file codebase. One genuine security concern exists: the extension strips Content-Security-Policy and X-Frame-Options headers from ALL URLs globally (:301-308), not just its target CRM domains, which weakens browser-level XSS and clickjacking protections site-wide — an architectural overshoot likely motivated by iframe embedding requirements.