Top Risks

• Free-webmail developer (gmail) with generic name 'ChromeExtensions' and no verified business identity.
• Brand impersonation: extension targets YouTube but developer has no confirmed ownership of YouTube/Google brand.
• Privacy policy hosted on Google Sites (free hosting) and does not disclose data retention.
• Extremely low install count (4) with no ratings — unproven trustworthiness.
• MV3 with no CSP declared; minor concern given no external hosts or code findings.

Evidence

• free_webmail_developer store Developer email binderpo343@gmail.com is free webmail; no business domain verified.
• brand_impersonation store brand_mention.is_impersonation=true; extension references YouTube brand; developer domain is gmail.com, not Google.
• generic_developer_name store Developer name 'ChromeExtensions' is non-specific and not tied to any verified entity.
• privacy_policy_free_hosting store Privacy policy on sites.google.com free hosting; retention not disclosed; third_party_silence=true.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust badges.
• minimal_install_base store Only 4 installs and 0 ratings; extension is essentially unknown/untested.
• code_clean crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts, no CVEs found.
• permissions_minimal manifest Only 'storage' permission and content_script scoped to youtube.com; no host_permissions declared.

Permissions Breakdown

• storage low Stores user layout preferences locally; minimal risk.
• content_scripts on *://*.youtube.com/* low Scoped narrowly to YouTube; matches stated function of layout customization.

Pillar Scores

Bookkeeping