Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• management permission allows disabling other extensions — unusually high capability for a cashback tool.
• Privacy policy fetched but scope_extension=false and data_collection=false; policy does not address this extension specifically.
• Dynamic script creation (script_src_dynamic) and new Function() constructor in background.js, communication.js, popup.js — remote code loading risk.
• Developer domain lolli.store does not resolve; reduces accountability.

Evidence

• management_permission manifest management permission declared; can enumerate/disable all other extensions installed by user.
• broad_host_access manifest host_permissions https://*/* with content_scripts on https://*/* — reaches every HTTPS site.
• developer_domain_not_resolving api threat_intel reports lolli.store does not resolve, reducing developer accountability.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false; generic policy not specific to extension.
• code_findings_dynamic_script crx script_src_dynamic in background.js, communication.js, popup.js — dynamic <script> creation detected.
• code_findings_function_constructor crx new Function() constructor found in 3 files; enables runtime code execution.
• dom_sink_innerhtml crx innerHTML sink in popup.js; no CSP present amplifies DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening declared.

Permissions Breakdown

• storage low Persists local user data; low standalone risk.
• alarms low Schedules background tasks; minimal risk.
• management high Can enumerate and disable other extensions; significant capability.
• declarativeNetRequest medium Can redirect/block network requests; medium risk.
• tabs medium Reads tab URLs and titles across browsing; moderate privacy impact.
• notifications low Shows notifications; low risk alone.
• webNavigation medium Observes all navigation events including URLs visited.
• https://*/* high Broad host access across all HTTPS sites; enables content script injection everywhere.

Pillar Scores

Scoring History

Bookkeeping