Is "TAG Site Request" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive.
Risk context: MEDIUM risk, score 61/100.
Evidence context: threat category none; evidence quality moderate.

This extension, "TAG Site Request," is designed for Chromebook users to request access to blocked websites through the TAG organization's administrative system. The evidence shows no malicious behavior, and all findings are explainable as false positives.

The IoC findings are dominated by known false positive patterns. The IP ::e in XIOC-IP-::e is an IPv6 fragment extracted from minified JavaScript, not a real network address. Multiple "domains" like date.now, data.name, info.name, info.email, and requests.map are property access chains that the XIOC extractor misidentifies as domains—this is documented noise per the CVEQ guidelines. The legitimate Google update endpoint https://clients2.google.com/service/update2/crx is expected infrastructure.

The only meaningful network finding is background.js:54 which triggers NET-FETCH-background.js-54, indicating a basic fetch call. This is consistent with the extension's stated purpose of submitting website access requests to admin.tag.org/api/chromebook/url-request. The domains admin.tag.org and tag.org align with the extension's description for TAG Chromebook management and are not suspicious third-party domains.

There are zero malware signatures, zero obfuscation findings, and zero credential theft indicators. The 6 code-smell findings are low-severity noise that match basic JavaScript patterns and should not drive verdicts per the guidelines.

Counterargument: A skeptic might argue the anonymous developer (personal Gmail address) with zero users is suspicious. However, this extension appears to be an internal tool for TAG Chromebook users, which explains the lack of public user count. The extension's functionality directly matches its description—requesting website access through an organizational API—which is a legitimate use case for school/enterprise Chromebook management. Without malware signatures, obfuscation, or actual suspicious third-party domains, the anonymous publisher alone does not constitute evidence of malicious intent.

Key Reasons

• All IoC findings are known false positive patterns (IPv6 fragments, property access chains)
• Zero malware signatures and zero obfuscation findings
• Network activity matches stated extension purpose (admin.tag.org API)
• No credential theft, browser hijacking, or typosquatting indicators

False Positive Considerations

• IPv6 fragment ::e from minified JS
• Property access chains misread as domains (date.now, data.name, info.email)
• Legitimate Google infrastructure domain (clients2.google.com)
• Organizational API domains matching extension purpose (admin.tag.org)