Top Risks

• Privacy policy does not scope data collection to this extension
• No Content Security Policy combined with innerHTML sinks
• Broad <all_urls> host permission on AI extension processing content
• Free Gmail developer contact with no verified publisher badge
• Install URL hijack detected (redirects on install)

Evidence

• privacy_policy_scope api Privacy policy fetched but scope_extension=false, no data collection/retention disclosed
• csp_missing manifest No Content Security Policy present (csp_present=false)
• dom_xss_sink crx innerHTML assignments from variables detected in contentScript.js and 647.js
• developer_identity store Free Gmail contact (photosolveteam@gmail.com), no verified publisher badge
• install_hijack manifest install_url_hijack=true detected in manifest
• broad_host_access manifest host_permissions includes <all_urls> with content scripts on all sites
• category_ai store AI extension processing page content for question solving
• months_since_update store 6 months since last update

Permissions Breakdown

• contextMenus low Low impact context menu integration
• activeTab low Temporary access to active tab only
• scripting medium Can execute scripts programmatically on pages
• storage low Local storage for extension data
• <all_urls> high Broad host access to all websites

Pillar Scores

Bookkeeping