Top Risks

• Privacy policy not scoped to extension; admits data collection and third-party sharing
• <all_urls> content scripts on every site; broad surveillance capability
• Uninstall URL hijack to Google Forms survey (minor monetization signal)
• Free-webmail dev email with no business name despite verified publisher badge
• tabs permission combined with broad host access enables cross-site tracking

Evidence

• host_permissions manifest Broad host access: *://*/*, <all_urls>, paypal, googleapis
• content_scripts_matches manifest Universal content script injection on <all_urls>
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, 3rd_party=true
• uninstall_url_hijack crx setUninstallURL to Google Forms survey for monetization
• developer_email store appsmartz.com@gmail.com; free webmail, no business name
• verified_publisher store Web Store verified publisher badge present
• code_findings_raw crx No suspicious code findings; obfuscation=0.0
• install_count store 5,000 installs; low but not anomalous

Permissions Breakdown

• activeTab low Grants temporary access to active tab on user interaction
• tabs medium Can read tab URLs and metadata across all tabs
• identity low OAuth identity without scopes
• storage low Local extension storage only
• *://*/* high Broad host access to all sites
• https://*.paypal.com/* medium Payment processing integration
• <all_urls> high Universal content script injection on every site
• https://www.googleapis.com/* medium Google API access for auth/processing
• https://admin.unmix.audio/* low Developer-controlled API endpoint

Pillar Scores

Bookkeeping