Top Risks

• Privacy policy is Google's generic account policy, not scoped to this extension — admits data collection and 3rd-party sharing (score +10.0 privacy).
• Brand impersonation: uses YouTube™ and Google trademarks; developer is unverified protonmail user.
• Developer uses free webmail (protonmail) with no business domain — low accountability.
• Extension updated 15 months ago; moderately stale for a YouTube-dependent tool.
• No CSP declared (MV3 default mitigates, but no CSP + protonmail dev warrants watch).

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true; brands=['youtube','google']; confirmed_owner=false; not verified publisher.
• free_webmail_developer store Developer email toluschr@protonmail.com; no business domain; domain_age_ct not queried (free_webmail).
• maintenance_stale store Last updated April 4, 2024 (~15 months ago); 6-12mo band applies.
• no_csp manifest csp_present=false; MV3 default CSP applies but no explicit policy declared.
• external_host crx js_external_hosts=[translate.googleapis.com]; consistent with stated Google Translate API function.
• is_featured_by_google store Extension carries 'Follows recommended practices' badge from Google Web Store.
• code_clean crx code_findings_raw=[], obfuscation_score=0.0, no CVEs, no bad host hits.

Permissions Breakdown

• storage low Stores user preferences; no cross-site data exposure.
• *://*.youtube.com/* medium Host permission scoped to YouTube only; matches stated translation function.

Pillar Scores

Bookkeeping