Real Tennis

The manifest declares externally_connectable with the wildcard <all_urls>, allowing any webpage on the internet to invoke chrome.runtime.connect() or chrome.runtime.sendMessage() into this extension. This is entirely unnecessary for a standalone tennis game and represents an unnecessary expansion of the extension's attack surface. Although background.js currently has no onMessage listener, this declaration makes the extension permanently reachable from any web origin and could be exploited if the publisher pushes an update that adds a handler.

{  "externally_connectable": {    "matches": [      "<all_urls>"    ]  }}

The popup embeds a clickable image overlay that loads from and links to multiaccount.cloudapi.stream. Combined with i.js lines 150-163 (a standalone 1-second timeout that forces this overlay visible regardless of game state), this means the extension's primary observable behaviour is surfacing an ad or redirect to an external domain rather than playing a game. The HTML file also declares script tags for five JS files (jquery, createjs, main.js, howler, Three.js) of which four are missing from the bundle, confirming the game is non-functional and the extension's stated purpose is a pretext.

<a href="https://multiaccount.cloudapi.stream/game.html" target="_blank"  style="position:absolute;bottom:10px;left:10px;" id="info_">  <img src="https://multiaccount.cloudapi.stream/game_image.jpg" id="image_0" style="max-width:300px;"></a>