Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Launchpad Hero [browser-hijack] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Developer uses free webmail (outlook.com) with no verified publisher badge — low accountability.
• Extension is 20 months stale (High maintenance risk) with 50K installs still active.
• DOM-XSS sink (innerHTML on user-controlled variable in popup.js) with no CSP to mitigate.
• Privacy policy discloses data collection and third-party sharing but extension has no declared permissions — scope mismatch warrants scrutiny.

Evidence

• developer_email_free_webmail store Developer email launchpadhero@outlook.com is a free webmail address; no verified publisher badge.
• months_since_update_20 store Last updated January 13, 2025; 20 months stale — scores in High maintenance band (6-12mo +3.5, 12-24mo +6.0 applied at 20mo).
• dom_sink_innerhtml_userctrl crx popup.js assigns user-controlled variable to innerHTML with no CSP; DOM-XSS risk.
• no_permissions_declared manifest permissions[], host_permissions[], and content_scripts_matches[] all empty — zero declared permissions.
• js_external_hosts_yahoo crx 12 Yahoo subdomains in js_external_hosts; extension contacts external hosts despite empty permissions — unusual.
• privacy_policy_data_collection_third_party api Privacy policy discloses data collection and third-party sharing; retention documented.
• csp_absent manifest content_security_policy is null; no CSP mitigates the innerHTML XSS sink.
• manifest_localized_placeholders manifest manifest_name and manifest_description use __MSG__ placeholders, obscuring store listing review.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Launchpad Hero [browser-hijack] [divergent] + malext.io malicious_extension_sentry; score 3.36 -> 5.86 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping