Top Risks

• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and third-party sharing (v3.5-D: +10.0).
• Install and uninstall URL hijacks redirect users to ali-assist.com/tutoriais and /un — install-funnel monetization pattern.
• Content script on <all_urls> gives full page-read/write capability across every site visited.
• 12 external JS hosts including awin1.com (affiliate network) and broker-qx.pro; no CSP to constrain them.
• Multiple innerHTML DOM-XSS sinks in bundled Bootstrap (no CSP present amplifies risk per FIX B).

Evidence

• privacy_policy_generic_google store privacy_policy_url points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5-D).
• install_url_hijack crx onInstalled opens https://www.ali-assist.com/tutoriais; uninstall redirects to /un — Webstore +2.0+3.0.
• content_scripts_all_urls manifest content_scripts_matches=[<all_urls>] with only low permissions[] declared; broad capability via script injection.
• awin1_affiliate_host crx js_external_hosts includes www.awin1.com (affiliate network); no CSP. Webstore affiliate signal considered.
• dom_xss_no_csp crx 4x innerHTML findings in Bootstrap bundle + productReviews.bundle.js; csp_present=false → FIX B elevated to +2.0.
• no_csp_mv3 manifest MV3 but content_security_policy=null; no mitigation for DOM-XSS sinks or external host contacts.
• featured_by_google store is_featured_by_google=true; applies -2.0 Reputation discount (Featured badge).
• broker_qx_pro_host crx js_external_hosts includes broker-qx.pro and app.ebinex.com — financial/crypto-adjacent domains with no stated purpose.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local extension data storage; no cross-origin data exfil capability.
• content_scripts:<all_urls> high Injects JS into every page visited; broad read/write access to all page content.

Pillar Scores

Scoring History

Bookkeeping