Top Risks

• Google brand impersonation by unverified gmail developer with no developer name set.
• cookies permission paired with scripting on labs.google enables session-token access.
• Privacy policy hosted on free GitHub Pages; third_party_sharing=true, no retention disclosed.
• Free-webmail dev (gmail), no developer name, no verified publisher — accountability gap.
• Small install count (50) + high-tier permissions = tail-attack surface anomaly.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; dev domain is gmail.com, not google.com; no verified publisher.
• free_webmail_dev_no_name store developer_email=bunhoeut@gmail.com; developer_name empty; no business website.
• cookies_permission manifest cookies declared alongside scripting and tabs; can read session cookies on scoped origin.
• third_party_sharing_in_policy api privacy_policy_classification: scope_extension=true, data_collection=false, third_party_sharing=true, retention=false.
• install_perm_anomaly store install_perm_anomaly: installs=50, small_install_high_perm=true.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit policy declared.
• gumroad_api_host crx api.gumroad.com in js_external_hosts; third-party commerce endpoint contacted.
• mail_google_com_host crx mail.google.com in js_external_hosts without corresponding host_permission; unexplained access.

Permissions Breakdown

• storage low Stores local extension state; low standalone risk.
• downloads medium Can trigger file downloads to user's machine.
• tabs medium Reads tab URLs and metadata across sessions.
• activeTab low Scoped to user-invoked interaction; limited reach.
• scripting medium Injects JS into pages; powerful if host access is broad.
• sidePanel low UI surface only; no data access by itself.
• cookies high Can read/write cookies; sensitive auth tokens accessible.
• https://labs.google/* medium Scoped host; scripting + cookies on this origin is elevated.
• https://aisandbox-pa.googleapis.com/* medium Internal Google AI API; outbound calls from extension context.
• https://api.gumroad.com/* medium License-check endpoint; third-party commerce API access.

Pillar Scores

Bookkeeping