Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Native messaging capability with unrecognized publisher
• Generic Google privacy policy (not scoped to extension)
• Broad host access (<all_urls>) with cookies and webRequest
• DOM-XSS sinks via innerHTML in multiple files

Evidence

• native_messaging_unverified crx nativeMessaging permission present, publisher_recognized=false
• privacy_policy_generic store Policy URL is generic Google account policy, scope_extension=false
• host_permissions_broad manifest <all_urls> declared with cookies, webRequest, scripting
• dom_xss_sinks crx innerHTML assigned from variable in 3 JS files
• management_capability manifest management permission allows control over other extensions
• external_host_kaspersky crx JS contacts touch.kaspersky.com (RU geo)
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected
• no_bad_hosts api threat_intel shows no bad_host, monetization, or affiliate hits

Permissions Breakdown

• contextMenus low Adds right-click menu items
• cookies high Session/credential access; paired with broad host access
• declarativeNetRequest medium Can modify network requests; no redirect rules detected
• management high Can enumerate/disable other extensions; high privilege
• storage low Local data persistence
• webRequest high Full traffic interception capability
• alarms low Scheduled tasks
• nativeMessaging high Can communicate with local companion apps
• scripting medium Can inject scripts into tabs
• tabs medium Tab enumeration and metadata access
• webNavigation medium Navigation event tracking
• <all_urls> high Content scripts on all HTTP/HTTPS sites

Pillar Scores

Bookkeeping