EG-DATA-008: Possible disclosure and transmission mismatch

What ExtensionGate detects

The rule combines package-derived outbound request evidence with the developer's explicit questionnaire answers. It flags when code can transmit a data category that an answer says is never transmitted.

It presents the endpoint literal, file evidence, and conflicting answer separately. It does not send a request or infer the contents of a production response.

Why it may matter

Store privacy forms, prominent disclosures, policies, and actual behavior should agree. Chrome's 2026 update says all collection must be prominently disclosed and necessary for the disclosed purpose.

A mismatch may be stale copy, unreachable code, a false interpretation, or real undisclosed behavior. Human review is therefore required.

Synthetic failing example

// Synthetic code evidence
fetch("https://api.example.test/analyze", {
  method: "POST",
  body: JSON.stringify({ pageUrl: location.href })
});

Questionnaire answer: "Page URLs never leave the device."

The package can send a page URL while the synthetic answer denies that transmission. Reachability and real backend use still require investigation.

Passing or legitimate example

Questionnaire answer:
"When the user selects Analyze, the page URL is sent to api.example.test
to return the requested result. It is retained for up to 24 hours."

This synthetic answer is specific and consistent with the shown code evidence; counsel and store forms may require additional detail.

Remediation

1. Confirm whether the request is reachable, what fields are sent, and under which user action or consent.
2. Stop unnecessary transmission or update product behavior, prominent disclosure, privacy policy, and store answers consistently.
3. Document purpose, recipients, security, retention, deletion, and vendors.
4. Test denied-consent, signed-out, error, and uninstall paths with network inspection.

False-positive boundaries

• A URL literal may be test-only, dead code, or a public non-user-data endpoint.
• The questionnaire answer may use different terminology for the same data category.
• Local browser access is not itself transmission; this rule requires correlated request evidence.

What static analysis cannot determine

• Encrypted, dynamically assembled, native-messaging, or backend-to-backend transfers may be invisible.
• Static analysis cannot observe production payloads, retention, deletion, or vendor contracts.
• The scanner cannot provide legal conclusions or determine whether consent is valid in a jurisdiction.

Official sources

• Chrome Web Store policy updates for 2026
• Chrome Web Store program policies
• Microsoft Edge extension developer policies

Rule version history

Related guides

• Privacy disclosure checklist
• Chrome August 2026 policy update