Top Risks

• Privacy policy admits data collection + third-party sharing with no extension-specific scope (scores max).
• webRequest + broad host access to Facebook/Instagram/X.com enables session token observation.
• Brand impersonation: mentions twitter/facebook/instagram without verified ownership; gmail dev.
• Uninstall URL hijack to third party detected; no developer name listed.
• innerHTML + new Function() in content scripts with no CSP amplifies DOM-XSS risk on major social platforms.

Evidence

• privacy_policy_admits_sharing_no_scope api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.0 (v3.5 D).
• brand_impersonation store brand_mention.is_impersonation=true; brands twitter/facebook/instagram; dev email gmail, not verified_publisher.
• uninstall_url_hijack crx uninstall_url_hijack=true; Webstore +3.0 per rubric.
• webRequest_broad_hosts manifest webRequest permission + host_permissions covering facebook/instagram/x.com and two unknown dev domains.
• no_csp crx content_security_policy=null; dom_sink_innerhtml_userctrl findings escalate to +2.0 each (FIX B).
• free_webmail_no_dev_name store developer_email=tikamchand06@gmail.com, developer_name empty; Reputation floor 7.5 triggered.
• dev_domain_tcmhack manifest host_permissions include *://*.tcmhack.in/* and *://*.tcmhack.com/* — unverified personal-brand domains.
• function_constructor_no_csp crx new Function() in content_script.js and popup.js with no CSP; code quality risk elevated.

Permissions Breakdown

• downloads medium Allows saving files to disk; expected for a media downloader.
• storage low Local settings persistence; low risk.
• webRequest high Can observe/intercept network requests across declared host scopes.
• https://*.x.com/ high Broad host access to Twitter/X; enables request interception and content injection.
• https://*.instagram.com/ high Broad host access to Instagram; same interception/injection risk.
• https://*.facebook.com/ high Broad host access to Facebook; session token exposure risk.
• *://localhost/* medium Access to localhost endpoints; potential SSRF or data exfil via local services.
• *://*.tcmhack.in/* high Unknown dev-owned domain with full request access; unverified third-party backend.
• *://*.tcmhack.com/* high Second unknown dev-owned domain; scope unclear, doubles exfil surface.
• *://*.socialdownloader.in/* medium Branded domain matching privacy policy host; still unverified backend.

Pillar Scores

Bookkeeping