Top Risks

• Free-webmail developer (gmail) with no verifiable business identity; floor at 7.5 for reputation.
• Extension contacts external CDN cdn.fbrq.io — unknown third-party with no clear justification.
• Severely stale: 29 months since last update raises supply-chain and abandonment risk.
• Privacy policy hosted on Google Sites, not scoped to this extension, no data collection or retention details.
• CSP sandbox permits unsafe-eval and unsafe-inline — weakens script security posture.

Evidence

• free_webmail_developer store Developer email ricardoronald401@gmail.com is free webmail with no associated business domain; reputation floor 7.5.
• external_js_host crx js_external_hosts includes cdn.fbrq.io — unknown CDN not attributable to developer or recognized service.
• stale_extension store Last updated March 2024; 29 months since update — maintenance pillar 8.5.
• privacy_policy_generic api Policy hosted on Google Sites; scope_extension=false, data_collection=false — generic non-scoped policy.
• csp_unsafe_eval manifest Sandbox CSP includes unsafe-eval and unsafe-inline on script-src, weakening script isolation.
• no_host_permissions manifest No host_permissions or content_scripts declared — low capability footprint.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false — no trust signals from Google.
• no_bad_host_hits api threat_intel bad_host_hits and monetization_hits are empty; affiliate_hits empty.

Permissions Breakdown

• storage low Stores local extension data only; no cross-site or sensitive access.

Pillar Scores

Bookkeeping