Top Risks

• Brand impersonation: title uses 'Google Chrome™' trademark; developer is gmail-only with no verified association.
• Privacy policy fetched but admits data collection and third-party sharing without scoping to this extension (v3.5 D: +10.0).
• Extension abandoned 45 months with no update; maintenance pillar maxes out.
• Uninstall URL hijack detected — redirects users to third-party destination on uninstall.
• Install URL hijack detected — opens third-party URL on install.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[google]; developer_domain=gmail.com; confirmed_owner=false.
• uninstall_url_hijack crx uninstall_url_hijack=true; target unknown. Webstore +3.0 per rubric.
• install_url_hijack crx install_url_hijack=true; target unknown. Webstore +2.0 per rubric.
• privacy_policy_generic_admits_sharing api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → v3.5D: +10.0.
• stale_extension store months_since_update=45 (>36mo); maintenance score=10.0.
• free_webmail_developer store developer_email=makeappsforfree@gmail.com; no verified publisher; no business domain.
• dom_xss_sink crx js/common.js: innerHTML assigned from variable; no CSP present → code quality +2.0.
• no_csp manifest content_security_policy=null; MV3 so no +2.0 network penalty, but dom_sink upgraded to +2.0.

Pillar Scores

Bookkeeping