What our analysis found

Trellix Endpoint Security Web Control, used by 6,000,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by unauthorized data collection. Its permissions mean it can observe network requests.

Key findings

• high· unauthorized data collection —The extension gathers the full URL of every visited page (via chrome.tabs.onUpdated) and sends it to the native host as a telemetry event. This is a clear collection of browsing history that is not disclosed in the Chrome Web Store privacy practices (which state 'none declared'). The data is transmitted to a first-party component, but the lack of disclosure makes this unauthorized data collection.

The extension collects full browsing URLs on every tab update and sends them as telemetry to the native host via reportStat, without any disclosure in the Chrome Web Store listing (disclosed data collection: none). This unauthorized data collection raises suspicion, even though the extension otherwise appears to function as an enterprise web filtering tool. The ML risk score (0.02) and the third-party likelihood assessment are low, but the undisclosed collection contradicts the CWS transparency requirements.