Top Risks

• AI extension processing page content (B2B lead generation)
• Install URL hijack detected
• 256 installs with no content_scripts or host_permissions declared
• Free-webmail developer (gmail.com) with no business website listed

Evidence

• permissions_low_surface manifest 4 LOW-risk permissions, 0 host_permissions, 0 content_scripts_matches
• ai_extension_page_processing store AI/Gen-AI extension processing page content for B2B lead generation
• install_url_hijack crx chrome.runtime.onInstalled opens 3rd-party URL
• small_install_high_perm store 256 installs with limited declared permissions (tail-attack surface)
• developer_gmail store Free-webmail dev email (gmail.com) with no business website
• privacy_policy_adequate api Scoped privacy policy with collection, purpose, storage, retention disclosed
• no_cve_findings crx No known CVEs in bundled JS libraries
• csp_present_mv3 manifest MV3 with strict CSP; no remote script loading allowed

Permissions Breakdown

• storage low Standard local data storage; minimal risk surface
• sidePanel low UI panel rendering; no host access required
• notifications medium Can display system notifications; no broad host access
• alarms low Background timing; minimal capability

Pillar Scores

Bookkeeping