What our analysis found

Rugby Rush is rated caution by Extension Auditor. Our code review reported 3 findings (1 high, 2 medium), led by other. It comes from a publisher with 28 extensions and was last updated in April 2026.

Key findings

• high· other —The bundled manifest requests no permissions and no host_permissions, but the live Chrome Web Store listing for this extension declares `permissions: ["identity"]` and `host_permissions: [" ", " "]`. `identity` plus ` ` is precisely the capability pair needed to mint a Google OAuth access token via chrome.identity.getAuthToken and call Google APIs with it, and `wheel.cloudapi.stream` gives a destination on the domain named as C2 in the Socket 108-extension session-theft campaign — none of which a self-contained canvas rugby game, which in this build touches only localStorage, has any use for. The divergence between the archived package and the published manifest means the shipped build carries privileges absent from the code available for review, which is the signature of a staged / delayed-malicious update.
• medium· other —`externally_connectable` is opened to `<all_urls>`, which lets script on any website in the world call into this extension's service worker. It is inert in this specific build — grep across,, and finds no `onMessageExternal` or `onConnectExternal` handler — but it is a deliberate, functionless widening of the extension's attack surface in a game that never communicates with a web page, and paired with the live manifest's `identity` permission it is the standard shape for letting an attacker-controlled page ask the extension to hand over a Google OAuth token.
• medium· other —Every install, every auto-update and every uninstall opens a top-level browser tab at ` /`, a domain the publisher controls and the domain recorded as the C2 for the Socket 108-extension data-exfiltration campaign. The payload itself (install reason + extension id) is not sensitive, but handing a campaign-controlled origin an attacker-timed, first-party top-level navigation on every silent background update — in a game with no account, no backend and no network code anywhere else in the bundle — is a remote-controlled delivery channel, not install analytics, and the extension's CWS disclosure declares no data collection at all. The same domain hosts the publisher's only privacy policy, so the first-party-destination exemption cannot be used to clear it.

The game code in this bundle is a clean, unmodified CodeThisLab 'Rugby Rush' HTML5 template ( is + CreateJS game logic; is the stock template glue; /* is stock Bootstrap 5.3.7 and is not even loaded by), and the bundled manifest declares zero permissions and zero host_permissions. The incriminating evidence is the mismatch with the live CWS manifest, which declares `identity` plus host_permissions ` and ` — i.e. the shipped extension holds Google OAuth-token capability and a channel to a cloudapi.stream subdomain that nothing in this archived game build needs or uses — combined with:16-22 opening top-level tabs at `cloudapi.stream` on every install, update and uninstall. cloudapi.stream is the C2 named in the Socket 108-extension data-exfiltration / session-theft campaign, and it is also the domain hosting this publisher's entire 'privacy policy', so the usual first-party-destination exemption does not clear it; the malicious sibling extensions corroborate but are not my basis. Confidence is medium, not high, because the code that would use `identity` is not in what I was given: this extraction is badly incomplete (15 files versus the 5,191 / 15-JS the ML features were computed over; loads jquery-3.2.1, createjs, screenfull, sprintf, howler and CLang., none of which are present, and there is no `_locales/` despite the manifest's `__MSG_` placeholders), so I could read no code that exercises the live manifest's privileges.