Back To Close

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-10. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality strong.

The Back To Close extension implements a simple utility function: closing the active tab when navigating back to the first history entry. The evidence reveals no malicious behavior, only known false-positive patterns from the CVEQ analysis pipeline.

The 25 IoC findings are entirely consistent with documented XIOC extractor garbage. Findings like XIOC-DOMAIN-c.call, XIOC-DOMAIN-n.next, XIOC-DOMAIN-t.tab.id, and XIOC-DOMAIN-e.name are property access chains from JavaScript code (e.g., c.call(), n.next, t.tab.id) misidentified as domain names. The XIOC-DOMAIN-window.top finding references the browser's window.top API, not a network domain. These patterns are explicitly documented as false positives in the CVEQ threat model.

The legitimate domains detected are benign infrastructure: https://clients2.google.com/service/update2/crx is Google's standard Chrome extension update service, and wxt.dev references the Web Extension Toolkit development framework. The GitHub issue link https://github.com/wxt-dev/wxt/issues/371 is a development reference, not malicious infrastructure.

The single manifest finding MANIFEST-SENSITIVE-PERM-TABS in manifest.json is appropriate for this extension's stated functionality. An extension that closes tabs based on navigation behavior requires the tabs permission—this is not excessive or suspicious.

Zero malware signatures were detected. Zero obfuscation findings were flagged. The 8 code-smell findings are classified as low-severity patterns that match basic JavaScript constructs and should not drive verdicts per the documented false-positive rules.

Counterargument: A skeptic might point to the anonymous developer ([email protected]) and low user count (8) as risk factors. While anonymous publishing is worth noting, it alone does not indicate malicious intent. Many legitimate developers use Gmail addresses for Chrome Web Store publishing. The low user count reflects a niche utility rather than malicious distribution. Without actual malware signatures, suspicious domains, or obfuscated payloads, these metadata factors are insufficient to override the clear false-positive evidence.

The high finding count (34 total) is driven entirely by XIOC extractor noise on property access chains, not by malicious content. This extension's behavior matches its description, and all findings have benign explanations.

Key Reasons

• All IoC findings are XIOC extractor false positives (property access chains like c.call, n.next, t.tab.id)
• Zero malware signatures detected
• Zero obfuscation findings
• Legitimate Google update service and WXT framework domains only
• Tabs permission is appropriate for stated functionality

False Positive Considerations

• XIOC property access chain misidentification (c.call, n.next, t.tab.id, e.name)
• Legitimate Google infrastructure domains (clients2.google.com)
• WXT development framework references (wxt.dev, GitHub issue links)
• Code-smell findings on basic JavaScript patterns