Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• cookies + scripting + <all_urls> enables full session credential access on every site visited.
• browsingData and contentSettings grant destructive/override capability across the entire browser.
• 24 months since last update places extension in stale maintenance band with 1M+ users.
• No CSP (MV3 default enforced, but 12 external JS hosts contacted including non-dev domains).

Evidence

• broad_host_access manifest host_permissions=[<all_urls>] + content_scripts on <all_urls>; amplifies cookies/scripting risk.
• generic_privacy_policy store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy +10.
• stale_maintenance store Last updated June 2024; months_since_update=24 → Maintenance +6.0.
• verified_publisher store verified_publisher=true; chrispederick.com resolves, not throwaway. Discount capped at -1.0 (monetization_hits check: empty, so full -3 applies but v3.5(E) not triggered).
• external_js_hosts crx 12 external JS hosts including beautifier.io, validator.w3.org, wave.webaim.org — dev-tool references, justify broad network.
• install_url_hijack crx install_url_hijack=true targeting chrispederick.com/work/web-developer — own domain, not 3rd-party hijack.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; 48 JS files scanned cleanly.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.

Permissions Breakdown

• browsingData high Can clear browsing history, cookies, cache — destructive and sensitive.
• contentSettings high Can change per-site content settings (JS, plugins, popups) globally.
• cookies high Read/write cookies across all sites; session hijack risk when paired with <all_urls>.
• history medium Full browsing history access; significant privacy exposure.
• scripting high Programmatic script injection into any page via <all_urls> host permission.
• storage low Local extension storage only; low standalone risk.
• tabs medium Access to tab URLs and metadata across all open tabs.
• <all_urls> (host_permission) high Broad host access amplifies cookies, scripting, and browsingData risks ×1.2.

Pillar Scores

Bookkeeping