What our analysis found

Smoothwall Safeguarding Client (Global), used by 3,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in August 2026.

The extension is a legitimate school web filtering and monitoring tool published by Smoothwall (a known educational security vendor). The keylogging and data collection are disclosed as 'User activity' and 'Website content' in the CWS listing, and the destination is the publisher's own managed service (Smoothwall Monitor). The broad permissions are necessary for web filtering, device monitoring, and identity management. No code patterns indicate hidden data exfiltration to unauthorized parties, and the keylogging includes privacy filters (e.g., redacting credit card numbers, ignoring password fields). The publisher has a trusted badge and a valid privacy policy. This is a clear false positive from the ML model, which over-weighted permissions and pattern counts.