Top Risks

• import_scripts_remote from gstatic + dynamic script creation enables remote code execution surface in SW context.
• new Function() on user-controlled data in content.js runs arbitrary code inside email page context.
• cookies + <all_urls> + scripting combo: extension can read session cookies and inject scripts on every site.
• Privacy policy not scoped to this extension; data_collection=true with third_party_silence=true.
• 12 external JS hosts including shortened-link.com, bitli.pro, bitt.site — link-shortening domains raise exfil concern.

Evidence

• import_scripts_remote crx firebase-messaging-sw.js loads remote gstatic URL via importScripts — remote code loading in service worker.
• function_constructor+user_input crx content.js: new Function() on e.trim() — arbitrary JS eval in email page content script.
• script_src_dynamic crx lib/xtion.js creates dynamic <script src=...> element — can load arbitrary external scripts.
• cookies+<all_urls>+scripting manifest Triple HIGH permission combo allows cookie theft and JS injection across all sites.
• external_hosts_suspicious crx js_external_hosts includes shortened-link.com, bitli.pro, bitt.site — opaque link-shortener domains.
• privacy_policy_scope_mismatch api Policy fetched but scope_extension=false; data_collection=true; third_party_silence=true.
• monetization_hit api Google Analytics telemetry hit present; only telemetry-tier.
• verified_publisher+featured store verified_publisher=true and is_featured_by_google=true; applies reputation discount.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata.
• storage low Stores extension preferences locally.
• unlimitedStorage low Allows large local data; minor risk.
• cookies high Can read/write cookies across domains with <all_urls>.
• declarativeNetRequest medium Block/redirect rules; core to tracker-blocking function.
• declarativeNetRequestWithHostAccess high Host-access-gated network request modification — broad capability.
• declarativeNetRequestFeedback medium Reads which rules fired; exposes browsing pattern data.
• gcm medium Google Cloud Messaging; can receive push messages.
• notifications low Shows desktop notifications; limited standalone risk.
• scripting high Injects scripts into pages; paired with <all_urls> is high-risk.
• offscreen low Off-screen DOM; limited surface area.
• alarms low Scheduled background tasks; low standalone risk.
• webNavigation medium Observes navigation events; can infer browsing activity.
• <all_urls> high Host permission covering all sites — maximum REACH.

Pillar Scores

Bookkeeping