Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified business identity or domain.
• install_url_hijack: onInstalled opens https://www.bing.com/maps — unsolicited redirect.
• DOM-XSS sink (innerHTML with user-controlled variable) and no CSP — elevated XSS risk.
• 17 months since last update with no verified publisher — stale, low-accountability extension.

Evidence

• install_url_hijack manifest onInstalled opens https://www.bing.com/maps — unexpected 3rd-party redirect on install.
• privacy_policy_generic store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email watoolsbr@gmail.com; no business domain; domain_age_ct not queried.
• dom_sink_innerhtml_userctrl crx innerHTML sink in extractLeads/index.js with no CSP; DOM-XSS risk.
• stale_extension store 17 months since last update; not verified publisher; not featured.
• js_external_hosts crx Extension references github.com, react.dev, www.bing.com, www.google.com as external hosts.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction declared.
• content_scripts_bing manifest Content script injected into https://*.bing.com/* — all Bing pages in scope.

Permissions Breakdown

• storage low Stores local extension data; no remote exfil risk alone.
• alarms low Schedules periodic tasks; low standalone risk.
• tabs medium Can read tab URLs/titles; moderate surveillance potential.
• content_scripts:https://*.bing.com/* medium Injects JS into all Bing pages; enables DOM reading/manipulation on Bing.

Pillar Scores

Bookkeeping