Top Risks

• Broad host access (<all_urls> + scripting) allows script injection on every site visited.
• Privacy policy is Google's generic account policy — not scoped to this extension at all; admits data collection and 3rd-party sharing.
• No last-updated date available; maintenance status unknown.
• Developer email uses yandex.com free-mail domain with no verified business identity.
• DOM-XSS sink (innerHTML) in bundled CodeMirror with no CSP; exploitable if JSON input is attacker-controlled.

Evidence

• broad_host_access manifest host_permissions include *://*/* and <all_urls>; content_scripts also match <all_urls>.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• privacy_policy_generic store Policy URL is Google myaccount policy (460KB); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_mail_developer store developer_email teocci@yandex.com; yandex.com is a free-webmail provider.
• dom_xss_sink crx codemirror.js: innerHTML assigned from variable; no CSP and no CVE data to bound severity.
• maintenance_unknown store last_updated and months_since_update both null; cannot confirm active maintenance.
• installs_100k store 100,000 installs; meaningful blast radius if compromised.
• no_bad_hosts api threat_intel shows empty bad_host_hits, affiliate_hits, and monetization_hits.

Permissions Breakdown

• clipboardWrite medium Can write to clipboard; reasonable for copy-JSON feature.
• scripting high Allows programmatic script injection into pages; elevated risk when paired with <all_urls>.
• activeTab low Scoped to user-invoked tab; lower risk than broad host access alone.
• contextMenus low UI integration only; no data-access capability.
• storage low Local settings persistence; low standalone risk.
• *://*/* high Broad host access covering all URLs; enables content-script injection everywhere.
• <all_urls> high Redundant with *://*/* but reinforces all-URL reach; anti-double-count applied.

Pillar Scores

Bookkeeping