PixViewer

The bundled manifest declares zero permissions, yet the live CWS listing for this same extension ID discloses permissions=[storage, scripting, declarativeNetRequest] and host_permissions=[<all_urls>]. 'scripting' grants programmatic JS injection into any page, and 'declarativeNetRequest' grants the ability to block or redirect network requests — both high-capability APIs entirely absent from the analysed code. The discrepancy strongly indicates a version on the store that differs from the ZIP captured for analysis, consistent with a post-install permission-escalation update pattern.

{  "name": "Image Viewer+",  "author": "skyfighteer",  "version": "1.0.1",  "manifest_version": 3,  "content_scripts": [    {      "js": ["content-script.js"],      "matches": ["<all_urls>"]    }  ]  // NO 'permissions' or 'host_permissions' keys present}

The extension identity inside the ZIP (name 'Image Viewer+', author 'skyfighteer') does not match the CWS listing (name 'PixViewer', publisher 'nmihaly0113'). An identity mismatch of this magnitude — both name and author — suggests the extension was transferred or rebranded, which is a known vector for bait-and-switch attacks where a clean extension acquires users before ownership changes and a malicious update is pushed. This corroborates the permission mismatch above.

{  "name": "Image Viewer+",  "author": "skyfighteer",  ...}// CWS listing name: 'PixViewer', publisher account: 'nmihaly0113'