Top Risks

• Content script runs on <all_urls> giving broad page-read/write access across all sites.
• Privacy policy is generic Google account policy, not scoped to this extension; data practices undisclosed.
• Developer uses free Gmail address with no verifiable business identity or domain.
• Extension calls out to developer-controlled API (api.findandreplace.top) with unknown data handling.
• No CSP declared (MV3 strict default applies, but API endpoint trust unverifiable).

Evidence

• content_scripts_all_urls manifest content_scripts_matches=["<all_urls>"] injects script into every page user visits.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_free_webmail store Developer email zhanghengyou5@gmail.com; no business domain or verified publisher badge.
• api_host_permissions manifest host_permission to https://api.findandreplace.top/*; developer-controlled, unverified.
• is_featured_by_google store Extension carries 'Featured' badge reducing reputation risk somewhat.
• no_cve_no_bad_hosts crx cve_findings_raw empty; threat_intel bad_host_hits and affiliate_hits empty.
• no_obfuscation_no_code_findings crx obfuscation_score=0.0; code_findings_raw empty; 5 JS files scanned cleanly.
• recently_updated store months_since_update=0; actively maintained as of June 2026.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; paired with scripting raises reach.
• activeTab medium Grants temporary access to active tab content on user action.
• scripting medium Allows injecting JS into pages; broad given content_scripts <all_urls>.
• storage low Local data persistence; low risk in isolation.
• contextMenus low Adds right-click menu items; minimal risk.
• alarms low Scheduled callbacks; low risk on its own.
• host_permission: https://api.findandreplace.top/* medium Extension contacts a dev-controlled API endpoint; unverified domain identity.
• content_scripts: <all_urls> high Script injected into every page the user visits; high reach combined with scripting.

Pillar Scores

Bookkeeping