Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — YouTube Row Fixer: Grid & Layout Customizer [data-theft] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail developer (gmail) with generic name 'ChromeExtensions' and no verified business identity.
• Brand impersonation: extension targets YouTube but developer has no confirmed ownership of YouTube/Google brand.
• Privacy policy hosted on Google Sites (free hosting) and does not disclose data retention.
• Extremely low install count (4) with no ratings — unproven trustworthiness.

Evidence

• free_webmail_developer store Developer email binderpo343@gmail.com is free webmail; no business domain verified.
• brand_impersonation store brand_mention.is_impersonation=true; extension references YouTube brand; developer domain is gmail.com, not Google.
• generic_developer_name store Developer name 'ChromeExtensions' is non-specific and not tied to any verified entity.
• privacy_policy_free_hosting store Privacy policy on sites.google.com free hosting; retention not disclosed; third_party_silence=true.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust badges.
• minimal_install_base store Only 4 installs and 0 ratings; extension is essentially unknown/untested.
• code_clean crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts, no CVEs found.
• permissions_minimal manifest Only 'storage' permission and content_script scoped to youtube.com; no host_permissions declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — YouTube Row Fixer: Grid & Layout Customizer [data-theft] [divergent] + malext.io malicious_extension_sentry; score 3.15 -> 5.65 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores user layout preferences locally; minimal risk.
• content_scripts on *://*.youtube.com/* low Scoped narrowly to YouTube; matches stated function of layout customization.

Pillar Scores

Bookkeeping