Keyboard & Mouse for Xbox Cloud Gaming (xCloud)
Score-based assessment (minimal risk, 0/100). Last analyst review covers version 4.1.0.
Analysis record
- Analysed
- 1 months ago
- Version
- v4.2.0
- Artifact
- SHA256 104…34B
- Source
- Findings (non-IoC)
No Findings
All security checks passed
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
No Threats Detected
This extension passed all security checks
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality absent.
The extension Keyboard & Mouse for Xbox Cloud Gaming (xCloud) version 4.1.0 contains no detectable malware signatures, no network communication to suspicious domains, and no obfuscated payloads. The analysis reports zero findings across all categories, including IoCs, malware, network requests, and code‑smell rules. The manifest and source files did not trigger any YARA rules for known threats, and no secret values or credential‑related patterns were identified. The developer address [email protected] is listed, and the extension’s description clearly states its purpose – enabling keyboard and mouse input for Xbox Cloud Gaming – without any claim to be from Microsoft or Xbox, reducing impersonation concerns. With 100 000 users and no evidence of hijacking, credential theft, proxyware, or other high‑confidence threat indicators, the extension appears to be a legitimate utility that offers functionality that could be misused only if a user deliberately grants it excessive permissions, which is not indicated in the current manifest.
A skeptic might argue that the absence of findings could be due to incomplete scanning or that the extension could load remote code at runtime. However, the static analysis covered all packaged files, and no dynamic loading constructs (e.g., eval, Function, or remote script injection) were found. Additionally, the extension’s version is recent (4.1.0) and the store metadata shows no recent updates that would suggest a malicious payload was added after the scan. Therefore, the lack of detections is best interpreted as a true clean result rather than a blind spot.
Overall, the extension presents no observable security risk based on the available evidence.
Key Reasons
- Zero malware‑signature findings
- Zero network/Ioc findings
- No obfuscation or code‑smell detections
- Clear, non‑impersonating description
Reviewed 2026-05-23; recommended action: no action; model confidence 95%.
Chrome version history
Risk trend by version
5 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.