Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Free-webmail developer (gmail.com) with no verified business domain; elevated accountability gap.
• Uninstall URL hijack flag set; destination unknown, potential tracking or redirect abuse.
• Install URL hijack flag set; destination unknown, possible affiliate or ad-tech redirect.
• 12 external JS hosts referenced across 4 countries with no CSP; broad uncontrolled network surface.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google account policy, not extension-specific; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email yokris.dev@gmail.com — gmail.com; no business domain resolvable; domain_age_ct not queried.
• install_url_hijack crx install_url_hijack=true, install_url_target=null; onInstalled fires external URL; destination unknown.
• uninstall_url_hijack crx uninstall_url_hijack=true, uninstall_url_target=null; setUninstallURL fires external URL; destination unknown.
• js_external_hosts crx 12 distinct external JS hosts including foo.com, webbrowsertools.com, mths.be; 4 countries; no CSP.
• description_promise_mismatch store Description promises ad/popup-blocking but lacks declarativeNetRequest/webRequest; reliance on scripting+<all_urls> only.
• no_csp crx content_security_policy is null; MV3 has strict defaults but external host list is broad.
• is_featured store is_featured_by_google=true; applies -2.0 Featured discount to Reputation pillar.

Permissions Breakdown

• storage low Stores extension settings locally; minimal risk.
• scripting medium Allows dynamic script injection; medium risk on its own.
• <all_urls> (host_permission) high Broad host access across every site; pairs with scripting for high capability.

Pillar Scores

Scoring History

Bookkeeping