What our analysis found

OneGlass Extension is rated caution by Extension Auditor. Our code review reported 3 findings (1 critical, 1 high, 1 medium), led by other. Its permissions mean it can inject scripts into pages.

Key findings

• critical· other —The extension strips `content-security-policy` and `x-frame-options` response headers from every URL the browser fetches, not just the declared CRM domains. Removing CSP globally eliminates inline-script protections on banking, email, and other sensitive sites, enabling XSS exploitation by any injected content. Removing X-Frame-Options globally eliminates clickjacking protection on all websites. Even if the developer's intent was to allow the extension's iframe injection on CRM pages, scoping to `<all_urls>` makes this a system-wide security downgrade for every site the user visits.
• high· other —The bundled (installed) manifest is Manifest V2 and includes `webRequest`, `webRequestBlocking`, and `<all_urls>`, none of which appear in the live CWS-published manifest (which is MV3 and lists only `identity`, `activeTab`, `notifications`, `scripting`, `storage`, `tabs`). Users who install from the Chrome Web Store see a narrower permission set than what actually runs — the installed extension has blocking network interception capability that the store listing does not disclose. This discrepancy between the installed and published manifest is itself a high-severity finding under the manifest mismatch check.
• medium· credential theft —A SalesLoft API Bearer token (`v2_ak_102653_…`) is hardcoded verbatim in the extension source. Because Chrome extension source is readable by any installed user, this credential is effectively public to every person who has the extension installed. An attacker with access to the token can query the SalesLoft API for data associated with the account, exfiltrate leads, or perform actions within the SalesLoft account. The token should be provisioned per-user via OAuth or fetched at runtime from the extension's backend after authentication.

OneGlass is a legitimate enterprise CRM-telephony tool, but three concrete security issues were found in the source code. Most critically, strips `content-security-policy` and `x-frame-options` response headers from ALL URLs (`<all_urls>`) in blocking mode — not scoped to the CRM integrations — weakening every website the user visits against XSS and clickjacking. Additionally, the bundled manifest is MV2 with `webRequest`, `webRequestBlocking`, and `<all_urls>` permissions, while the published CWS manifest shows MV3 without those permissions, meaning users believe they installed a less-capable extension than what is actually running. A hardcoded SalesLoft API Bearer token in is a credential exposure risk. The publisher (thomas.lamb@, verified Accenture) is credible and the CRM functionality is entirely coherent, arguing against intentional malice — but the global header-stripping and permission discrepancy are real harms that corroborate the ML flag rather than explain it away.