Top Risks

• Google generic privacy policy used — does not describe what this extension collects or shares.
• API key hardcoded in host_permissions URL; any reviewer can extract and abuse it.
• No CSP + innerHTML assigned from XHR response — DOM-XSS sink if TinyURL response is compromised.
• Free webmail developer (gmail.com) with no business domain; no accountability chain.
• Extension stale at 24 months with no privacy disclosure; future sale/hijack risk.

Evidence

• privacy_policy_generic store Policy is Google's own account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• hardcoded_api_key manifest host_permissions includes URL with apikey=jAwRRNby2drjTzwXYR6wL3C9gQgbEtI1aYEPumiDPAU3porwA0dBShq5Hx68.
• dom_xss_sink crx popup.js assigns xhr.responseText directly to resultDiv.innerHTML with no CSP to mitigate.
• free_webmail_developer store Developer email torishitagrawal@gmail.com; no business website; domain_age_ct not queried.
• maintenance_stale store Last updated June 2024; months_since_update=24; no changelog visible.
• no_csp manifest content_security_policy is null; MV3 default applies but dom-sink risk elevated without explicit CSP.
• low_install_base store 271 installs; small audience limits blast radius but also limits community oversight.
• cve_findings_none crx No CVEs detected in bundled libraries; cve_findings_raw is empty.

Permissions Breakdown

• storage low Local storage for settings/state; no cross-site data exposure.
• activeTab low Access to current tab URL only on user action; scoped and transient.
• host:https://api.tinyurl.com/* medium API key hardcoded in host permission URL — credential exposure risk.
• host:https://tinyurl.com/* low Scoped to TinyURL domain matching stated function.

Pillar Scores

Bookkeeping