Top Risks

• MANAGEMENT PERMISSION: extension can enumerate and disable other installed extensions (incl. security and privacy tools).
• management permission allows full enumeration and control of all installed browser extensions.
• Developer uses free-webmail (gmail) with no verified business identity or developer name.
• innerHTML DOM-XSS sink in popup.js; if extension data is attacker-influenced, XSS possible.
• Privacy policy discloses third-party sharing without specifying recipients or retention period.

Evidence

• management_permission manifest management declared — can enumerate/disable/uninstall all extensions; justified by security-scanner category.
• free_webmail_developer store Developer email jmrrizkallah@gmail.com; no developer name; no verified business website.
• verified_publisher store verified_publisher=true; provides partial reputation credit but free-webmail floors reputation.
• dom_xss_sink crx popup.js assigns contentEl.innerHTML = html; potential DOM-XSS if extension metadata is tainted.
• privacy_third_party_sharing api Privacy policy fetched; scope_extension=true, data_collection=false, but third_party_sharing=true, retention=false.
• install_perm_anomaly store 731 installs with high-tier permission (management); small_install_high_perm=true.
• github_blocklist_dependency manifest Blocklist fetched from raw.githubusercontent.com/toborrm9 — repo could be hijacked if account compromised.
• cve_findings crx No CVEs detected; no known-bad hosts; no obfuscation (score=0.0).

Permissions Breakdown

• management high Can enumerate, enable/disable, or uninstall other extensions — core function but powerful.
• storage low Local data persistence; no cross-site risk.
• alarms low Scheduling periodic scans; low inherent risk.
• notifications low Displays alerts to user; no data exfil surface.
• https://raw.githubusercontent.com/toborrm9/malicious_extension_sentry/* medium Fetches blocklist from GitHub; repo ownership ties to dev but external dependency.
• https://chromewebstore.google.com/* low Read Chrome Web Store pages for extension metadata; matches stated function.
• https://chrome.google.com/webstore/* low Legacy webstore URL; same rationale as above.
• https://microsoftedge.microsoft.com/* low Edge Add-ons store access for cross-store scanning; matches stated function.

Pillar Scores

Bookkeeping