Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10 privacy pillar).
• Developer name (tau.lexwebb.1700639556232) is a timestamped alias; email claims google.com domain but publisher is not verified — possible impersonation risk.
• Description explicitly states 'testing purposes' — not a production/enterprise-grade extension.
• Very low install count (30) with unverifiable developer identity limits trust signal.

Evidence

• generic_privacy_policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to this extension.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; email devanaganvi@google.com but confirmed_owner=false.
• testing_extension store Manifest description: 'Extension for testing purposes Extension for testing purposes' — not production software.
• low_install_count api Only 30 installs; tail-attack-surface anomaly not flagged by automated check but context raises scrutiny.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable JS libraries detected.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; single JS file scanned with no exfil indicators.
• narrow_host_permission manifest Only http://www.google.com declared; no broad host access, no content scripts, no high-impact permissions.
• developer_domain_resolves api threat_intel reports google.com resolves=true, looks_throwaway=false; no bad/monetization/affiliate hits.

Permissions Breakdown

• http://www.google.com low Narrow single-domain host permission; limited reach, no sensitive data access implied.

Pillar Scores

Bookkeeping