Top Risks

• Broad host access (<all_urls> content script + http/https/*) with scripting permission enables full page read/write on every site.
• innerHTML DOM-XSS sink in contentScript.js running on all pages increases XSS attack surface.
• Free-webmail developer (gmail) with no listed developer name reduces accountability.
• install_url_hijack and uninstall_url_hijack flags set; redirect targets unknown.
• Privacy policy discloses third-party sharing but data_collection field is false — policy adequacy unclear.

Evidence

• broad_host_access manifest host_permissions http://*/* and https://*/* plus content_scripts on <all_urls> — full page access every site.
• dom_xss_sink crx innerHTML assignment from variable in contentScript.js and PDFViewer.js — DOM-XSS risk on all pages.
• function_constructor crx new Function() in pdf.worker.min.js and PDFViewer.js — likely PDF.js eval-support check, low direct risk.
• install_uninstall_hijack store install_url_hijack and uninstall_url_hijack both true; targets null — redirect destination unverifiable.
• free_webmail_developer store Developer email ks.palmaa@gmail.com with no developer name listed — limited accountability.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true — positive trust signals applied.
• privacy_third_party_sharing api Privacy policy scoped to extension, no data_collection claimed, but third_party_sharing=true — +1.0 privacy.
• js_external_hosts crx 7 external hosts in CSP/JS including api.ttsreader.cc, github.com, reactjs.org — 3 distinct registrable domains beyond dev.

Permissions Breakdown

• activeTab low Scoped to user-initiated tab interaction only.
• tabs medium Can read tab URLs and metadata across all tabs.
• scripting high Paired with <all_urls> host permission; can inject code into any page.
• storage low Local data persistence, limited blast radius.
• identity low OAuth token access; no broad scopes declared.
• contextMenus low UI integration only, no data access.
• http://*/* high Broad host access to all HTTP sites.
• https://*/* high Broad host access to all HTTPS sites.
• content_scripts <all_urls> high Content script injected into every page visited.

Pillar Scores

Bookkeeping