Top Risks

• <all_urls> host permission combined with scripting allows script injection on any site visited.
• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and third-party sharing.
• Free-webmail developer (gmail) with no verified business identity or verified publisher badge.
• DOM-XSS sink (innerHTML from variable) in options.js with no CSP — exploitable if input is attacker-controlled.
• No content_security_policy defined; MV3 default partially mitigates but DOM sink is still present.

Evidence

• host_permissions_broad manifest <all_urls> declared alongside scripting permission — can inject JS on every site.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Developer email is thebestwebservices@gmail.com — free webmail, no verified business domain.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in js/options.js; no CSP present to mitigate exploitation.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• external_host_surface crx js_external_hosts includes popper.js.org — external JS dependency contact point.
• maintenance store Last updated July 2025 (~11 months); 3-6 month stale band applies.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust anchors present.

Permissions Breakdown

• notifications medium Needed for Pomodoro alerts; medium reach but expected for this category.
• offscreen low Allows off-screen document; low risk, used for audio/timer in MV3.
• storage low Stores timer settings locally; no exfil risk on its own.
• idle low Detects user idle state; low capability risk.
• activeTab medium Access to currently active tab on user gesture; scoped but scriptable.
• scripting medium Can inject scripts; paired with <all_urls> host permission raises risk.
• <all_urls> (host_permission) high Broad host access across all sites; combined with scripting is a significant capability.

Pillar Scores

Bookkeeping