Top Risks

• nativeMessaging with unrecognized publisher — arbitrary code execution on host OS possible.
• Microsoft brand impersonation by gmail.com developer with no verified ownership.
• Extension not updated in 45 months — abandoned, acquisition risk.
• Privacy policy is Google's generic account policy — does not scope to this extension; data collection and 3rd-party sharing admitted.
• install_url_hijack and uninstall_url_hijack both true — redirects user on install/uninstall.

Evidence

• nativeMessaging_unrecognized_publisher crx has_native_messaging=true, publisher_recognized=false — +3.0 permissions.
• brand_impersonation_microsoft store brand_mention.is_impersonation=true, confirmed_owner=false, developer on gmail.com.
• install_and_uninstall_url_hijack crx install_url_hijack=true and uninstall_url_hijack=true — webstore +2.0+3.0.
• abandoned_extension store last_updated September 2022, months_since_update=45 — maintenance score 10.0.
• generic_google_privacy_policy api Policy is myaccount.google.com; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• no_csp crx content_security_policy=null; MV3 strict default applies — no extra network penalty.
• free_webmail_developer store Developer email thomas.davis.19791210@gmail.com — numbered alias pattern on free webmail.
• dom_sink_innerhtml crx dom_sink_innerhtml_userctrl in js/common.js; no CSP present — elevated XSS risk.

Permissions Breakdown

• storage low Stores local extension preferences; low risk in isolation.
• contextMenus low Adds right-click menu items; limited capability.
• nativeMessaging high Communicates with native host app; publisher not recognized — full OS-level escape risk.

Pillar Scores

Scoring History

Bookkeeping