A few things: * Tavis Ormandy is the researcher doing the reporting. He's currently employed at Google as a security researcher. Given his reputation, and Goog

A few things: * Tavis Ormandy is the researcher doing the reporting. He's currently employed at Google as a security researcher. Given his reputation, and Google's reputation, I trust that his reports are true reports, rather than fiction. * The report covers a span of ~13 days. It's entirely possible that the AVG commentary that you read was posted on or after 2015-12-21, the date on which Mr. Ormandy mentions that AVG reports that they're going to be pushing the fixed version of the extension into the Chrome Webstore. * It's also entirely possible that the AVG commentary that you read is either a pack of lies, or -when read very closely- says a _bunch_ of things but ultimately utterly fails to say anything like "The thing reported by Mr. Ormandy in Google Security Research Issue #675 is actually not a problem. Mr. Ormandy's reports are untrue.".