Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Adobe Lightroom Photo Editor (fake) [credential-theft] (+2.0, capped).
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension (generic Google Sites policy).
• Brand impersonation: extension names YouTube and Netflix without verified ownership.
• Developer is free-webmail only (gmail) with no business domain; unverifiable identity.
• Extension last updated 35 months ago — approaching zombie status with 20K installs.

Evidence

• brand_impersonation store brands_mentioned=[youtube,netflix], confirmed_owner=false, is_impersonation=true.
• free_webmail_developer store developer_email=barreiro01919@gmail.com; no business domain; identity unverifiable.
• privacy_policy_generic_admits_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) +10.0.
• maintenance_stale store months_since_update=35; in 24-36mo band → +8.5.
• no_bad_hosts_or_affiliates api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no malicious network signals.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0; code quality pillar 0.0.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount (Featured badge).
• install_count_20k store 20,000 installs; >10K webstore signal +1.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Adobe Lightroom Photo Editor (fake) [credential-theft]; score 5.57 -> 7.57 (+2.0 cap 2.5).

Permissions Breakdown

• activeTab low Grants access to current tab only on user gesture; low blast radius.
• scripting medium Allows programmatic script injection into pages; medium risk without broad host perms.

Pillar Scores

Bookkeeping