Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, but admits data collection and third-party sharing (+10.0 privacy).
• Uninstall URL redirects to developer-controlled GitHub page; minor hijack signal.
• Developer uses free webmail (gmail.com) with no verified business domain, raising accountability concerns.
• <all_urls> host permission combined with 'scripting' allows code injection on every site the user visits.
• Extension is 16 months stale (featured but not updated since Feb 2025); moderate abandonment risk.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer manifest Developer email is @gmail.com with no business domain; increases reputation risk.
• host_permissions_all_urls manifest <all_urls> host permission + scripting enables injection on every site.
• uninstall_url_hijack crx setUninstallURL targets andreto.github.io — developer-owned but still a 3rd-party redirect.
• no_csp manifest content_security_policy is null; MV3 defaults apply but no explicit CSP hardening.
• is_featured_by_google store Extension carries Google Featured badge, partially mitigating reputation risk.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; high-tier permission with sub-10K installs.
• maintenance_stale store Last updated Feb 2025; 16 months since update → +6.0 maintenance pillar.

Permissions Breakdown

• storage low Stores user highlight preferences locally; low impact.
• scripting medium Allows programmatic script injection; elevated when paired with <all_urls>.
• <all_urls> (host_permissions) high Content scripts run on every site; broad surface area for data access.

Pillar Scores

Bookkeeping