Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension; admits data collection and 3rd-party sharing (D clause → +10.0 privacy pillar).
• Brand impersonation: 'Google' mentioned in title but developer is not Google/verified owner (+2.0 reputation).
• No CSP declared on MV3 extension with 800K installs; MV2 penalty not applicable but no observable surface area with large user base.
• Maintenance: 13 months since last update (6-12 month band +3.5, borderline 12-24 +6.0 at 13mo → applied +6.0).
• No developer name listed; email domain stefanvd.net resolves but dev identity unverified.

Evidence

• privacy_policy_generic store Privacy URL points to myaccount.google.com generic policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer is not confirmed Google owner → +2.0 reputation.
• verified_publisher store verified_publisher=true; discount applies but months_since_update=13 and generic policy trigger 0c cap at -1.0.
• no_csp manifest content_security_policy=null on MV3; no high/medium CVEs so CVE amplifier does not apply.
• stale_maintenance store months_since_update=13 falls in 12-24mo band → +6.0 maintenance pillar.
• no_permissions manifest permissions=[], host_permissions=[], content_scripts_matches=[] — zero declared permissions; permissions pillar = 0.
• no_js_surface crx js_file_count=0, code_findings_raw=[], obfuscation_score=0.0; code quality pillar = 0.
• network_mv3_no_csp manifest MV3 with null CSP; no external hosts detected; +2.0 network for MV2 rule does not apply (MV3), base network = 2.0 for null CSP signal only.

Pillar Scores

Bookkeeping