Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer domain graphiteeater.com does not resolve; accountability gap for contact@graphiteeater.com.
• Brand impersonation: extension name and TM use of 'YouTube Music™' by unverified owner.
• Three innerHTML DOM-XSS sinks across content/popup/sidepanel JS with no CSP to mitigate.
• React 16.13.1 bundled; below recommended 16.14+ threshold; no CSP amplifies risk.

Evidence

• generic_privacy_policy store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• developer_domain_not_resolving api threat_intel reports graphiteeater.com resolves=false; dev has no reachable web presence.
• brand_impersonation store brand_mention.is_impersonation=true; confirmed_owner=false; mentions YouTube brand without ownership.
• dom_xss_sinks_no_csp crx 3x dom_sink_innerhtml_userctrl findings; csp_present=false → each escalates to +2.0 (FIX B).
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; provides reputation discount but capped by non-resolving domain.
• react_16_13_1_no_csp crx React 16.13.1 detected (below 16.14); no CSP present — v2 jquery/<3.5+no-CSP analog applies +2.0 code quality.
• no_developer_name store developer_name is empty string; no public identity beyond email.
• installs_40k store 40,000 installs — reach amplifier for any exploitation of DOM-XSS sinks.

Permissions Breakdown

• storage low Local preference/state persistence; low standalone risk.
• scripting medium Programmatic script injection; scoped to music.youtube.com only.
• notifications low Desktop notification push; limited abuse surface.
• search medium Access to browser search API; potential for search-provider interaction.
• sidePanel low UI side panel; no data-exfil risk on its own.
• host: https://music.youtube.com/* medium Content-script host limited to YT Music; narrow scope but DOM-XSS sinks present.

Pillar Scores

Bookkeeping