Top Risks

• Privacy policy fetched but scope_extension=false and admits data collection + third-party sharing — scores maximum privacy risk.
• manifest_source=html_fallback: no CRX permissions, code, or manifest version available; full permission surface unknown.
• Developer name missing from listing; no verified publisher badge.
• Description promises ad-blocking but no webRequest/declarativeNetRequest detected — possible mismatch signal.
• 16M installs amplifies any latent risk if future update introduces malicious behavior.

Evidence

• manifest_source_fallback store manifest_source=html_fallback; permissions, host_permissions, and JS surface unavailable — permission pillar scored 0 for lack of evidence.
• privacy_policy_generic api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — v3.5 rule D applies: +10.0 privacy.
• featured_by_google store is_featured_by_google=true provides -2.0 reputation discount.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty applied.
• description_mismatch store description_promise.mismatches: promises ad-blocking but lacks declarativeNetRequest/webRequest in detected permissions.
• high_install_count store 16M installs: +1.0+1.0+0.5 webstore signals; -0.5 popularity-as-trust (installs>1M, rating 4.7).
• no_cve_no_bad_hosts api cve_findings_raw=[], bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — clean threat intel.
• recently_updated store months_since_update=0; maintenance pillar=0.0.

Pillar Scores

Scoring History

Bookkeeping