Top Risks

• Free-webmail dev (gmail) with no developer name listed; identity not verifiable despite verified-publisher badge.
• webRequest + declarativeNetRequestWithHostAccess + scripting + <all_urls> enables full request interception and script injection on every site.
• No CSP combined with dynamic script creation and new Function() across multiple files allows runtime code execution.
• Privacy policy admits data collection and third-party sharing but lacks retention details; scope is extension-specific.
• Contacts ip-api.com (geolocation) and Google Analytics in addition to reactjs.org; 3 external hosts with no CSP.

Evidence

• free_webmail_dev_no_name store developer_email=getvideohunter@gmail.com, developer_name empty; reputation floor elevated.
• verified_publisher_featured store verified_publisher=true, is_featured_by_google=true; discounts applied but capped per invariants.
• high_permissions_broad_host manifest webRequest + declarativeNetRequestWithHostAccess + scripting all paired with <all_urls> host permission.
• no_csp crx content_security_policy=null; MV3 default CSP applies but no explicit hardening; amplifies code risks.
• dynamic_script_and_function_constructor crx script_src_dynamic + function_constructor found in popup.js, offscreen.js, player.js.
• privacy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• external_hosts_ip_api crx js_external_hosts includes ip-api.com (geolocation), reactjs.org, www.google-analytics.com.
• monetization_hit_analytics api threat_intel.monetization_hits: google-analytics.com (telemetry tier); category is VideoDownloader.

Permissions Breakdown

• tabs medium Access to tab URLs/titles; needed for video detection.
• storage low Local key-value storage; low risk.
• unlimitedStorage low Extended local storage; minor risk.
• offscreen medium Allows off-screen DOM processing; used in media extraction.
• scripting medium Programmatic script injection into pages; significant capability.
• webRequest high Intercepts all network requests across all URLs; HIGH capability.
• declarativeNetRequestWithHostAccess high Can block/redirect requests on any host; HIGH capability.
• notifications low Desktop notifications; low risk.
• downloads medium Initiates file downloads; core to stated function.
• sidePanel low Side-panel UI; low risk.
• <all_urls> (host) high Content scripts inject into every URL; broad reach amplifies webRequest/scripting.

Pillar Scores

Bookkeeping