Top Risks

• <all_urls> host permission combined with scripting allows JS injection on every site visited.
• Privacy policy fetched but scope_extension==false and admits data collection + third-party sharing — not scoped to this extension.
• function_constructor (new Function) in background.js is a dynamic code execution risk.
• innerHTML from variable in sidepanel.js is a DOM-XSS sink; CSP allows unsafe-inline on script-src-elem.
• Small install base (123) with HIGH permissions is a tail-attack-surface signal.

Evidence

• host_permissions_all_urls + scripting manifest <all_urls> + scripting permission combo allows code injection on every site.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic, unscoped.
• function_constructor_code_finding crx new Function() detected in background.js — dynamic code execution path.
• dom_xss_sink crx innerHTML from variable in sidepanel.js; CSP has unsafe-inline on script-src-elem.
• small_install_high_perm_anomaly store install_perm_anomaly.small_install_high_perm=true; 123 installs with <all_urls>+scripting.
• external_js_hosts crx Extension contacts pdftools-ff51f.web.app and pqina.nl — 2 external domains.
• maintenance_6_12_months store Last updated June 2025; ~12 months since update — borderline stale.
• no_verified_publisher store Developer not verified; dev domain convertpdfonline.net resolves but not badge-verified.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; moderate risk alone.
• scripting high Allows JS injection into pages; elevated with <all_urls>.
• storage low Local extension data storage only.
• activeTab low Scoped to user-initiated interaction; limited blast radius.
• sidePanel low UI surface only, no data access on its own.
• offscreen medium Allows hidden DOM operations; can run scripts off-screen.
• <all_urls> high Broad host access paired with scripting; high-risk combination.

Pillar Scores

Bookkeeping