Top Risks

• Privacy policy is Google's generic corporate policy; does not scope data collection to this extension specifically.
• Content scripts declared on <all_urls> giving broad page-read reach across all sites.
• 21 months since last update; moderately stale for a 34M-install extension.
• No CSP defined (MV3 default applies, but explicit policy absent).
• Generic Google policy admits data collection and third-party sharing without extension-specific disclosure.

Evidence

• recognized_org store Developer email @google.com, confirmed owner of Google brand; not impersonation.
• privacy_policy_scope api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy per v3.5 rule D.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; broad host reach on every visited page.
• maintenance_stale store Last updated Sep 2024; 21 months since update → +6.0 maintenance pillar.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; no malicious patterns found.
• threat_intel_clean api No bad_host_hits, affiliate_hits, or monetization_hits; developer domain google.com resolves.
• featured_by_google store is_featured_by_google=true; recognized org discount applied; reputation floored at 2.0.

Permissions Breakdown

• activeTab low Access only to current tab on user action; scoped and low-risk.
• contextMenus low Adds right-click menu items; no data access by itself.
• storage low Local preferences storage; no cross-site risk.
• offscreen low MV3 offscreen document for background tasks; limited surface.
• scripting medium Can inject scripts into pages; paired with <all_urls> content_scripts raises capability.
• content_scripts:<all_urls> high Content scripts run on every page, broad host reach for a translation tool.

Pillar Scores

Scoring History

Bookkeeping