Top Risks

• Privacy policy is generic Google account policy — not scoped to this extension, admits data collection and third-party sharing.
• Content scripts injected on all HTTP/HTTPS pages gives full DOM access to every site visited.
• Developer uses free Gmail address with no verifiable business identity.
• install_url_hijack flag is true — extension opens a URL on install (target unknown).
• Extension stale at 24 months with small install base (343) but high-tier permissions — tail attack surface.

Evidence

• broad_content_scripts manifest content_scripts_matches: http://*/* and https://*/* — injected on every page the user visits.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Developer email foxlymeteam@gmail.com — no verified business domain; reputation floor 7.5 applied.
• install_url_hijack crx install_url_hijack=true, target=null; extension opens third-party URL on install.
• install_perm_anomaly api small_install_high_perm=true, tail_attack_surface=true; 343 installs with broad host + content-script access.
• stale_extension store Last updated June 2024; 24 months since update — maintenance score 6.0.
• js_external_host crx app.foxlyme.com is the sole external JS host; single country (US), no bad-host hits.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — code quality clean.

Permissions Breakdown

• tabs medium Can read tab URLs and titles; moderate data exposure.
• storage low Local data persistence; low standalone risk.
• activeTab low Scoped to user-triggered action; limited exposure.
• https://*/* high Broad host access across all HTTPS sites via host_permissions.
• content_scripts: http://* + https://*/* high Content scripts injected on all pages; full DOM read/write on every site.

Pillar Scores

Bookkeeping