Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension at all; data practices entirely opaque.
• Broad host permissions (http://*/*, https://*/*) with content scripts on all pages enable full page read/write.
• Uninstall URL hijack detected — extension registers a third-party URL on uninstall.
• dom_sink_innerhtml_userctrl in contentScript.bundle.js combined with all-sites content script is a DOM-XSS risk.
• new Function() constructor in jscolor.js enables arbitrary code execution from parsed input.

Evidence

• broad_host_access manifest host_permissions and content_scripts both cover http://* and https://* — full page access on every site.
• privacy_policy_not_scoped store Privacy URL resolves to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; target not captured but pattern matches monetization/tracking redirect.
• dom_sink_innerhtml_userctrl crx innerHTML set from variable in contentScript.bundle.js; CSP present but DOM-XSS sink still exploitable via page content.
• function_constructor crx new Function() in jscolor.js used to parse color config strings — arbitrary code path if input is attacker-controlled.
• featured_by_google store Extension carries Google Featured badge — partial trust signal offsetting some reputation risk.
• js_external_hosts crx References 5 external hosts: beta.myatoms.io, browser.google.com, jscolor.com, odvarko.cz, www.gnu.org.
• no_cve_findings crx cve_findings_raw empty; no known-vulnerable bundled libraries detected.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; medium risk on its own.
• contextMenus low Adds right-click menu items; minimal data access.
• alarms low Schedules background tasks; no data access.
• storage low Local extension storage; scoped to extension only.
• http://*/* high Broad host access enables content script injection on all HTTP sites.
• https://*/* high Broad host access enables content script injection on all HTTPS sites.

Pillar Scores

Bookkeeping