Top Risks

• Brand impersonation: uses 'YouTube' brand name without being affiliated with Google/YouTube.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail.com) with no verified business identity.
• No CSP on MV3; innerHTML DOM-XSS sink in bundled React 16.13.1 code.
• Persistent scripting access to YouTube Studio; 15 months since last update increases staleness risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[youtube], confirmed_owner=false; dev is gmail user DashingPrune.
• free_webmail_dev manifest developer_email=daashingdev67@gmail.com; no business domain, no verified publisher badge.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy pillar (v3.5-D).
• dom_xss_sink crx dom_sink_innerhtml_userctrl in assets/index-BRSoZGa4.js; no CSP present, triggers +2.0 code quality (FIX B).
• no_csp manifest content_security_policy=null on MV3; +2.0 network behavior (MV2+no-CSP rule not applicable but noted; base network risk applies).
• host_permissions_youtube_studio manifest Persistent access to http(s)://studio.youtube.com/* enables script injection into creator dashboard.
• maintenance_stale store months_since_update=15 (12-24mo band) → +6.0 maintenance pillar.
• react_16_bundled crx react@16.13.1 bundled; below 16.4 threshold; paired with no CSP and innerHTML sink adds DOM-XSS exposure.

Permissions Breakdown

• scripting medium Can inject scripts into pages; scoped to activeTab and studio.youtube.com host permissions.
• storage low Local data persistence only, low standalone risk.
• activeTab low Temporary access to current tab on user action; limited scope.
• http://studio.youtube.com/* medium Persistent host access to YouTube Studio; enables script injection and data read on the platform.
• https://studio.youtube.com/* medium Persistent host access to YouTube Studio; enables script injection and data read on the platform.

Pillar Scores

Bookkeeping