Top Risks

• Privacy policy is only 43 chars, not fetched as meaningful text; scope_extension=false, data_collection=false — effectively no real policy.
• content_scripts run on <all_urls> giving broad page-content access on all sites visited by 100K users.
• Developer identified only by free Gmail address (joeddo89@gmail.com) with no developer name listed.
• No CSP declared (MV3 default applies but js_external_hosts include vuejs.org and localhost beside dev domains).
• AI extension processes page content and sends to ddict.me backend with inadequate data handling disclosure.

Evidence

• content_scripts_all_urls manifest content_scripts matches <all_urls>; extension can read/modify every page the user visits.
• privacy_policy_inadequate crx Policy fetched but only 43 chars long; scope_extension=false, data_collection=false — not a meaningful policy.
• gmail_developer_no_name store Developer email joeddo89@gmail.com; developer_name is empty; no verified business identity.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; mitigates reputation concern partially.
• js_external_hosts crx 7 external hosts: api/app/learn/ddict.me (dev-owned), translate.google.com, vuejs.org, localhost.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit policy declared.
• ai_page_content_processing store AI translation extension with <all_urls> content scripts sends data to ddict.me backend.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — clean code scan.

Permissions Breakdown

• storage low Stores extension settings/preferences locally; minimal risk.
• declarativeNetRequest medium Can modify/block network requests; lower risk than webRequest but still capable.
• notifications low Shows browser notifications; limited abuse potential.
• contextMenus low Adds items to right-click menu; standard for translation tools.
• content_scripts <all_urls> high Injects scripts into every page the user visits; broad read/write access to page content.
• host: *://translate.google.com/* low Scoped to Google Translate API; matches stated translation function.
• host: *://translate.googleapis.com/* low Google Translate API endpoint; justified by function.
• host: *://ddict.me/* + *://*.ddict.me/* medium Developer-owned backend; necessary for AI features but allows data to leave browser.

Pillar Scores

Bookkeeping