Top Risks

• webRequest + cookies + *://*.instagram.com/* enables full session and credential interception on Instagram.
• Uninstall and install URL hijacks flagged — redirect behaviour on install/uninstall is a monetization/tracking signal.
• Free-webmail developer email (gmail) with no developer name reduces accountability.
• No CSP on MV3 extension with DOM-XSS innerHTML sink in content script.
• Small install base (303) with HIGH-tier permissions is a tail-attack-surface anomaly.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hooks set; classic monetization/tracking redirect pattern.
• cookies + webRequest + instagram host manifest cookies & webRequest scoped to instagram.com — capable of full session token exfiltration.
• no CSP + innerHTML sink crx csp_present==false and dom_sink_innerhtml_userctrl found in content-script; DOM-XSS risk elevated.
• free-webmail dev email, no developer name store superwebscraper.com@gmail.com with empty developer_name; low accountability.
• install_perm_anomaly api 303 installs with HIGH-tier permissions (webRequest, cookies, host access) flagged as tail-attack-surface.
• verified_publisher + featured store Both badges present; provides partial reputation discount but does not negate URL-hijack or session-access risk.
• js_external_hosts crx References reactjs.org, superwebscraper.com, www.instagram.com — 3 distinct registrable domains.
• privacy_policy_classification api Policy fetched, scoped, documents data collection, retention and third-party sharing — adequate.

Permissions Breakdown

• storage low Local state persistence; minimal risk.
• webRequest high Intercepts network requests; can observe Instagram auth/session traffic.
• cookies high Access to cookies on instagram.com; session hijack risk.
• downloads medium Can trigger file downloads; paired with content access raises risk.
• *://*.superwebscraper.com/* low Dev-controlled domain; limited reach.
• *://*.instagram.com/* high Full host access to Instagram; combined with cookies+webRequest = high exfil surface.

Pillar Scores

Bookkeeping