Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• webRequest + scripting + browsingData + <all_urls>: near-total browser control over every site visited by 300K users.
• management permission lets extension disable/uninstall competing security tools without user notice.
• No CSP (MV3) means function_constructor findings in service worker have no sandbox constraint.
• JS external hosts include tinyurl.com (URL obfuscation), facebook.com, tiktok.com — broad third-party reach beyond stated security function.

Evidence

• HIGH permissions: webRequest+scripting+browsingData+management+<all_urls> manifest Five high-risk capabilities combined grant full read/write/intercept control over all browsing.
• management permission manifest Can enumerate and disable/remove other installed extensions — atypical for a browser guard.
• csp_present == false crx MV3 extension without explicit CSP; no script-src restriction on service worker.
• function_constructor in service-worker files crx new Function() found in anti-malware.js and index.js; dynamic code execution risk without CSP guard.
• js_external_hosts include tinyurl.com, facebook.com, tiktok.com crx URL shortener and major social platforms beyond expected security-function scope.
• monetization_hits: google-analytics.com (telemetry tier) api Google Analytics contacted; only telemetry tier, low severity but adds to network surface.
• is_featured_by_google=true, verified_publisher=false store Featured badge present but no verified publisher badge reduces accountability signal.
• privacy_policy fetched, scoped, all fields true — adequate api Policy discloses collection, retention, third-party sharing scoped to this extension.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata across all open tabs.
• webNavigation medium Monitors navigation events; combined with <all_urls> widens reach.
• webRequest high Intercept/observe all HTTP requests across all sites.
• management high Can list, enable, disable, or uninstall other extensions.
• alarms low Schedules background callbacks; low standalone risk.
• storage low Local/sync storage; benign alone.
• scripting high Inject arbitrary scripts into any page under <all_urls>.
• browsingData high Delete history, cookies, cache; destructive capability.
• declarativeNetRequest medium Block/redirect network requests declaratively; less invasive than webRequest.
• <all_urls> (host) high Combined with scripting/webRequest grants access to every site visited.

Pillar Scores

Bookkeeping