Top Risks

• Content scripts injected on ALL URLs (<all_urls> + *://*/*) gives full page read/write on every site visited.
• Privacy policy is Google's generic account policy — does not scope to this extension at all (scope_extension=false, admits data_collection+third_party_sharing).
• Developer is a free-webmail (Gmail) address with no registered developer name or business domain.
• No content_security_policy (MV3 default strict, but absence means no extra hardening signal).
• Verified publisher badge partially mitigates, but generic Google policy admits collection/sharing — trust ceiling limited.

Evidence

• broad_host_access manifest host_permissions and content_scripts_matches both list <all_urls>/*://*/* — content scripts run on every page.
• generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email reddy.vivaanh@gmail.com; developer_name empty; no business domain.
• verified_publisher store verified_publisher=true and is_featured_by_google=true — partial trust signal.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; js_external_hosts empty — no malicious indicators detected.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.
• large_install_base store 2,000,000 installs — high blast radius if extension were compromised or transferred.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.

Permissions Breakdown

• storage low Stores user preferences locally; minimal risk.
• *://*/* high Broad host access; content scripts run on all URLs.
• <all_urls> high Redundant with *://*/* — grants full cross-origin read access via content scripts.

Pillar Scores

Bookkeeping