Is "hireEZ for Chrome - Find and Engage Anyone, Anywhere." on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is likely false positive with 75% confidence.

Recommended action: suppress false positive.
Risk context: MEDIUM risk, score 46/100.
Evidence context: threat category none; evidence quality weak.

The hireEZ extension presents two findings that require careful interpretation. The MANIFEST-SENSITIVE-PERM-TABS finding in manifest.json grants the tabs permission, which allows the extension to access browser tabs. However, this permission directly supports the extension's documented purpose: "Sourcing on LI/ATS, GPT Email Campaigns, Application Review, Gmail Assistant, Contact Finder, and Candidates Recommendation." A LinkedIn sourcing tool must access tabs to identify candidate profiles and extract contact information, making this permission functionally justified rather than suspicious.

The OBFUSCATION-INVISIBLE_ZERO_WIDTH-common.js-0 finding in common.js flags zero-width Unicode characters. While zero-width characters can indicate steganography in malicious code, this finding lacks corroborating evidence. There are zero malware signatures, zero suspicious IoCs, zero network findings, and zero code-smell findings. The CVEQ documentation explicitly warns that zero-width character findings can be false positives, particularly when not accompanied by malware signatures or suspicious domains. In this case, the obfuscation finding stands alone without any behavioral indicators of malicious intent.

The developer attribution [email protected] points to a legitimate recruiting technology company. Hiretual is a known B2B SaaS platform for sales intelligence and candidate sourcing, which aligns with the extension's functionality. The 20,000 user count is moderate and consistent with a legitimate business tool.

Counterargument: A skeptic could argue that zero-width characters in common.js represent intentional steganography to hide malicious payloads. However, this argument fails because: (1) there are no malware signatures in any file, (2) there are no suspicious network domains or IoCs to receive exfiltrated data, (3) there are no credential theft patterns or browser hijacking indicators, and (4) the extension's behavior matches its documented purpose. Without corroborating evidence, treating a single zero-width character finding as conclusive proof of malware violates the principle that finding NATURE matters more than finding COUNT. The verdict remains likely_false_positive because the evidence bundle contains no indicators of actual malicious behavior, only a pattern that can occur in legitimate code.

Key Reasons

• Zero malware signatures or suspicious IoCs despite obfuscation finding
• Tabs permission aligns with documented LinkedIn sourcing functionality
• Developer email points to legitimate recruiting platform (hiretual.com)
• No network findings or credential theft patterns detected
• Single obfuscation finding without corroborating malicious indicators

False Positive Considerations

• OBFUSCATION-INVISIBLE_ZERO_WIDTH without malware signatures
• Sensitive permission justified by extension functionality