Top Risks

• Generic Google privacy policy not scoped to extension; admits data collection and 3rd-party sharing
• DOM-XSS sink (innerHTML) in options.js without Content Security Policy
• Broad content_scripts match (<all_urls>) allows injection on all websites

Evidence

• privacy_policy api Generic Google account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true
• code_finding crx options.js innerHTML assignment from variable (dom_sink_innerhtml_userctrl) with no CSP present
• content_scripts manifest content_scripts_matches: <all_urls> (broad host access)
• permissions manifest tabs (medium risk); activeTab, storage, identity, notifications, power, offscreen (low risk)
• developer_identity store No developer name, email, or website provided
• threat_intel api No bad hosts, monetization, or affiliate networks detected; no CVEs in bundled libraries

Permissions Breakdown

• tabs medium Access to browser tab metadata and URLs
• activeTab low Temporary access to active tab on user gesture
• notifications low Display browser notifications
• storage low Local extension storage
• identity low OAuth identity (no scopes declared)
• power low Prevent system sleep/screen lock
• offscreen low Create offscreen documents for background processing

Pillar Scores

Bookkeeping