Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• webRequest + <all_urls>: can observe all HTTP/S traffic across every site the user visits.
• No CSP declared (MV3 mitigates partially but popup.js innerHTML sink is unmitigated).
• 22 months since last update — approaching zombie threshold with no active maintenance signal.
• Developer name absent; email domain sigmafxdx.com unrelated to any recognizable publisher.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension. scope_extension=false, third_party_sharing=true.
• webRequest_all_urls manifest webRequest permission combined with host_permissions:<all_urls> — full passive traffic inspection capability.
• dom_xss_sink crx popup.js assigns user-controlled variable to innerHTML with no CSP to block XSS escalation.
• no_csp manifest content_security_policy is null; MV3 default applies but popup innerHTML sink remains unmitigated.
• maintenance_stale store Last updated August 2024, 22 months ago — 6-12mo band score +3.5 does not apply; 18-24mo yields +6.0.
• verified_publisher_featured store Extension is verified_publisher=true and is_featured_by_google=true; discounts applied to reputation.
• developer_name_absent store developer_name is empty string; no 'Offered by' visible display name increases identity uncertainty.
• no_bad_hosts_no_affiliate api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits; no operator siblings.

Permissions Breakdown

• tabs medium Access to tab URLs/titles; needed to correlate network requests to tabs.
• storage low Local data persistence for captured URLs; low inherent risk.
• scripting medium Programmatic script injection into pages; medium risk without broad host pairing.
• webRequest high Observe all network requests across all URLs; core sniffing function but high capability.
• declarativeNetRequest medium Can block/redirect requests via static rules; lower risk than webRequestBlocking.
• clipboardWrite medium Can write to clipboard without user gesture; allows silent URL copying.
• <all_urls> (host_permissions) high Broad host access paired with webRequest; enables monitoring of all HTTP traffic.

Pillar Scores

Bookkeeping