Top Risks

• Privacy policy (gendigital.com/privacy) is not scoped to this extension and data_collection=false — opaque data handling for a 5M-user credential manager.
• No CSP present on MV3 extension with <all_urls> + scripting + webRequest; function_constructor calls and innerHTML sink amplify XSS risk.
• React 16.13.1 bundled; below XSS-fix threshold (16.4) with no CSP — DOM-XSS sink in vendor/libs.react.js is higher risk.
• Low rating (2.7) across a large install base; no developer display name despite corporate email, reducing accountability signals.
• Content scripts injected on <all_urls> including financial checkout pages (Amazon, Citi, Zappos) — broad credential/payment page access.

Evidence

• no_csp_mv3 manifest content_security_policy is null; MV3 default is stricter but absence of explicit CSP leaves eval-like constructs less constrained.
• privacy_policy_not_extension_scoped api gendigital.com/privacy: fetched=true, scope_extension=false, data_collection=false — generic corporate policy, not scoped to this extension.
• function_constructor_multiple_files crx new Function() constructor found in 6 content-script files; pattern is boilerplate globalThis polyfill but still present.
• dom_sink_innerhtml_no_csp crx innerHTML sink in vendor/libs.react.js (React 16.13.1 < 16.4); no CSP to mitigate DOM-XSS.
• verified_publisher_nortonlifelock store verified_publisher=true, developer_domain nortonlifelock.com resolves; recognized security brand.
• broad_host_permissions_password_manager manifest <all_urls> host permission + scripting + webRequest; justified for password manager but high capability surface.
• low_rating_large_install_base store Rating 2.7 on 5M installs; no review red flags in structured data but low score is notable.
• financial_checkout_content_scripts manifest Content scripts scoped to Amazon, Citi, Zappos, Steam checkout pages — direct access to payment flows.

Permissions Breakdown

• contextMenus low UI convenience; minimal data access.
• notifications low Display only; no data exfil risk.
• storage low Local extension state storage.
• tabs medium Can read tab URLs and titles across all sites.
• webNavigation medium Observe navigation events; tracks browsing patterns.
• webRequest high Observe all HTTP traffic on all URLs; paired with <all_urls>.
• alarms low Background scheduling only.
• clipboardWrite medium Can write to clipboard; password manager use case but sensitive.
• scripting high Inject scripts into any page; paired with <all_urls> broad reach.
• <all_urls> (host_permission) high Full access to all websites; required for password manager function.

Pillar Scores

Bookkeeping