Top Risks

• Broad host access (http://*/*, https://*/*) + cookies + webRequest enables full cross-site data visibility.
• Privacy policy not scoped to this extension and lacks data-collection/retention disclosures.
• new Function() constructor present; context appears globalThis polyfill but still an eval-class risk.
• 13M installs make this a high-value target if extension or supply chain is ever compromised.
• third_party_silence in privacy policy — no statement on whether data is shared with third parties.

Evidence

• verified_publisher + recognized_org (PayPal) store Verified publisher badge present; developer domain paypal.com resolves; confirmed brand owner.
• broad host permissions + cookies + webRequest manifest cookies & webRequest paired with <all_urls> — ×1.2 multiplier applied; justified-broad discount applied for Shopping.
• privacy policy not scoped to extension api fetched=true, scope_extension=false, data_collection=false → +9.0 privacy; third_party_silence adds +1.0.
• function_constructor in merchantSPBResponders.js crx new Function() use matches globalThis polyfill pattern; +2.5 code quality per debugger_attach/function_constructor rule.
• no CVEs, no bad hosts, no monetization/affiliate hits api cve_findings_raw=[], bad_host_hits=[], monetization_hits=[], affiliate_hits=[] — all clean.
• recently updated, MV3, strict CSP manifest Last updated June 2026 (0 months); MV3; CSP script-src 'self' only — no unsafe-eval/inline.
• operator cluster: no siblings api sibling_count=0 across dev_email, csp_host_set, compound fingerprints.
• no review red flags, no ownership change store review match_count=0; wayback ownership_changed=false.

CVE Exposures (2)

Permissions Breakdown

• cookies high Can read/write cookies across all sites via broad host_permissions.
• webRequest high Observe all network requests across all URLs; paired with <all_urls>.
• scripting medium Programmatic script injection into any page; justified for coupon application.
• http://*/* high Broad host access to all HTTP sites enables wide content-script reach.
• https://*/* high Broad host access to all HTTPS sites; core to Shopping category function.
• storage low Standard local state persistence.
• unlimitedStorage low Allows larger local data store; low direct risk.
• alarms low Periodic background wake; minimal risk.
• offscreen low Off-screen document for DOM tasks; limited surface.

Pillar Scores

Scoring History

Bookkeeping