Is "Character / Emoji Finder" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 75% confidence.

Recommended action: suppress false positive.
Risk context: MEDIUM risk, score 44/100.
Evidence context: threat category none; evidence quality moderate.

This extension, "Character / Emoji Finder," presents a minimal finding profile with only 2 medium-severity network findings in assets/js/script.js at lines 94 and 109. Both findings are generic "fetch" calls with no specific domain information extracted, meaning the XIOC extractor did not identify any suspicious URLs or endpoints. Critically, the extension has 0 malware signatures, 0 IoC findings, 0 obfuscation findings, and 0 code-smell findings.

The network findings in assets/js/script.js are consistent with legitimate functionality. An emoji/character finder extension would reasonably need to fetch character data, emoji lists, or search results from a server. Without domain-level IoCs, these fetch calls cannot be characterized as suspicious. The findings_summary confirms no suspicious domains were detected, no malware families matched, and no obfuscation techniques were identified.

The developer attribution ([email protected]) is an anonymous Gmail address rather than a verified organization. While this is a mild concern, it does not constitute evidence of malicious behavior. The extension's stated purpose aligns with its minimal capabilities: fetching and displaying characters/emojis for copy-paste use. There are no findings related to credential access, browser hijacking, proxyware functionality, or data exfiltration.

Counterargument: A skeptic might argue that the anonymous developer combined with network activity warrants caution. However, this reasoning conflates risk factors with evidence of harm. The threat model explicitly states that finding COUNT is not evidence—finding NATURE is. The 2 network findings are generic fetch calls without suspicious domains, malware signatures, or obfuscation. The absence of any high-confidence threat indicators (typosquatting, credential theft IoCs, malicious domains, malware signatures) means there is no evidence of intentional harm. The extension's low user count (92) suggests it is not widely deployed, reducing any potential impact. Without specific evidence of malicious behavior, the anonymous developer alone does not justify a malicious verdict.

The findings profile matches known false-positive patterns: network detectors flag basic fetch calls without domain context, and the scoring system inflates risk based on finding volume rather than finding nature. This extension's clean profile (no malware, no IoCs, no obfuscation) strongly indicates legitimate utility software.

Key Reasons

• Zero malware signatures, IoCs, obfuscation, or code-smell findings
• Network findings are generic fetch calls without suspicious domains
• Extension purpose (emoji finder) aligns with observed capabilities
• No evidence of credential theft, hijacking, or data exfiltration

False Positive Considerations

• Generic fetch calls flagged as network findings without domain context
• No suspicious domains extracted despite network activity