Top Risks

• Brand impersonation: uses Instagram trademark, developer is unaffiliated gmail user with no verified identity.
• webRequest + broad Instagram host permission allows interception of auth tokens, session cookies, and private media.
• Privacy policy is Google's generic account policy — not scoped to this extension at all; data handling undisclosed.
• Developer is anonymous gmail account with no name, no business website, no verified publisher status.
• Featured badge provides some trust signal but cannot override brand-impersonation + unaccountable developer identity.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'instagram'; developer is lonzndelo@gmail.com, confirmed_owner=false.
• free_webmail_dev_no_name store developer_email=lonzndelo@gmail.com, developer_name empty, no business domain — unaccountable identity.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• webRequest_high_capability manifest webRequest + https://*.instagram.com/* enables full interception of Instagram network traffic including auth.
• no_csp crx content_security_policy is null; MV3 strict default applies, mitigating remote-code risk somewhat.
• featured_badge store is_featured_by_google=true; partial trust signal, but does not verify developer identity or data handling.
• js_external_hosts crx 5 external hosts referenced: developer.mozilla.org, i.instagram.com, photoswipe.com, www.instagram.com, www.quirksmode.org.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; no active malicious code detected in scan.

Permissions Breakdown

• webRequest high Can observe and intercept all network requests to instagram.com; high capability for session/credential sniffing.
• tabs medium Access to tab URLs and metadata; combined with webRequest raises profile.
• downloads medium Can trigger file downloads; potential for data exfiltration via saved files.
• storage low Persists local data; low risk in isolation.
• host_permissions: https://*.instagram.com/* high Full access to all Instagram subdomains including auth tokens, DMs, media.

Pillar Scores

Bookkeeping