Top Risks

• Brand impersonation: uses 'Google' brand name, dev is unverified gmail user with no developer name.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Content scripts injected on <all_urls> with scripting permission; high capability over every site.
• 3x innerHTML DOM-XSS sinks across popup/options/calendar JS files with no CSP to mitigate.
• External host 'simple-calendar.com' in JS hosts and content scripts; unknown third-party domain.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[google], developer_domain=gmail.com, confirmed_owner=false.
• gmail_dev_no_name manifest developer_email=easy.calendar.extension@gmail.com, developer_name empty; free-webmail dev with no business identity.
• generic_privacy_policy store Policy is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_host_access_with_scripting manifest host_permissions=<all_urls> + scripting + content_scripts on <all_urls>; can read/modify every page.
• dom_xss_sinks_no_csp crx 3 files with dom_sink_innerhtml_userctrl; csp_present=false triggers FIX B +2.0 upgrade.
• external_third_party_host crx js_external_hosts includes simple-calendar.com and reactjs.org alongside Google APIs.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discounts applied but capped by invariant 0c.
• no_csp_mv3 manifest content_security_policy=null; MV3 has strict default but no explicit CSP amplifies XSS risk from innerHTML sinks.

Permissions Breakdown

• storage low Stores local extension data; limited risk.
• tabs medium Can read tab URLs and titles across all tabs.
• scripting high Can inject scripts into pages; combined with <all_urls> is high-impact.
• <all_urls> (host_permission) high Broad host access; content scripts run on every site visited.

Pillar Scores

Bookkeeping