The extension operates as described:
- It intercepts navigation events.
- It extracts and slightly sanitizes the URL (hostname and path, sometimes the full URL depending on the provider).
- It sends this URL-related data only to the servers of the declared security providers (Microsoft, Symantec, Emsisoft, etc.).
- It uses the responses to decide whether to block the navigation and show a local warning page.
- It uses local storage for settings and caching results.
- Minimal telemetry (a daily GUID) is sent only to Microsoft's API endpoint.
There is
no evidence in the provided code that the extension collects or transmits unrelated personal data (like browsing history across sites, cookies, form data, credentials) or sends any data to undeclared third-party servers. The broad host permission is necessary for its function but appears to be used responsibly within the context of contacting the declared security APIs.