Top Risks

• Extension last updated 43 months ago — abandoned, no security patches expected.
• Privacy policy is generic Google account policy; does not scope to this extension at all.
• innerHTML DOM-XSS sink in popup.bundle.js with no CSP to mitigate exploitation.
• new Function() constructor present — dynamic code execution risk without CSP guard.
• No developer display name; very low install count (15) with verified email but unverified identity.

Evidence

• maintenance_stale store Last updated November 2022; 43 months stale — full +10.0 maintenance score.
• privacy_policy_generic store Policy URL is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• csp_absent_mv3 manifest No content_security_policy declared; MV3 strict default applies — no MV2 +2.0 penalty.
• dom_sink_innerhtml_no_csp crx dom_sink_innerhtml_userctrl + csp_present==false triggers +2.0 code quality (FIX B).
• function_constructor crx new Function() constructor found in popup.bundle.js → +2.5 code quality.
• verified_publisher_stale_cap store verified_publisher=true but months_since_update=43 >18mo → discount capped at -1.0 (invariant 0c/v3.5 E).
• developer_name_missing store developer_name is empty string; no displayed identity in store listing.
• no_bad_hosts_no_cves crx threat_intel bad_host_hits=[], affiliate_hits=[], cve_findings_raw=[] — no active threat intel hits.

Permissions Breakdown

• storage low Stores local preferences; no cross-site data exposure.

Pillar Scores

Bookkeeping