Top Risks

• Brand impersonation: dev 'DeepSeek' using gmail stephankenny676@gmail.com is not confirmed owner of DeepSeek brand.
• Privacy policy is Google's generic policy (scope_extension=false, admits data_collection+third_party_sharing) — worst-case privacy: +10.0.
• Three moderate CVEs in bundled jquery@1.9.1 with no CSP; amplifier applies (jquery DOM-manipulation lib + no CSP).
• Broad host_permissions on *.google.com including accounts.google.com alongside content script on DeepSeek chat.
• Free-webmail developer with no verified business identity — future account transfer or compromise risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false; dev email is personal gmail, not deepseek.com.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• cve_jquery_1.9.1 crx jquery@1.9.1 carries 3 moderate XSS CVEs (CVE-2015-9251, CVE-2019-11358, CVE-2020-11023); no CSP amplifier applies.
• broad_google_host_permissions manifest host_permissions include https://*.google.com/* and http://*.google.com/* covering accounts.google.com.
• free_webmail_developer store Developer email stephankenny676@gmail.com; no business domain. Reputation floor >= 7.5 applies.
• is_featured_by_google store Extension carries Google Featured badge; partial trust signal, but does not override impersonation.
• jquery_second_version_3.5.1 crx License sidecar for jquery-3.5.1.slim present; vulnerable 1.9.1 also bundled in bootstrap.min.js.
• no_csp manifest content_security_policy=null (MV3 default strict, but CVE amplifier ×1.5 applied for jquery+no explicit CSP).

CVE Exposures (3)

Permissions Breakdown

• declarativeNetRequest medium Can block/modify network requests; lower risk than webRequest but still impactful.
• declarativeNetRequestFeedback low Read-only access to matched rule results; minimal standalone risk.
• sidePanel low Opens a side panel UI; no direct data access capability.
• commands low Registers keyboard shortcuts; minimal risk.
• webNavigation medium Can observe all navigation events across tabs, tracking browsing patterns.
• host:https://chat.deepseek.com/* medium Access to DeepSeek chat domain; content scripts run here.
• host:https://*.google.com/* high Broad access to all Google subdomains including accounts.google.com; sensitive auth context.
• host:https://deepseek.com/* medium Access to deepseek.com root and subdomains.

Pillar Scores

Scoring History

Bookkeeping