Top Risks

• Free-webmail dev (venomreborn@gmail.com), no developer name, no verified identity — high reputation risk.
• Privacy policy is Google's own account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• <all_urls> host permission paired with scripting allows code injection on every site the user visits.
• AI extension contacts openrouter.ai — page content could be exfiltrated to an LLM proxy; tinyurl.com introduces opaque redirect destination.
• Two innerHTML DOM-XSS sinks found; could be exploited if attacker controls page content fed into extension.

Evidence

• free_webmail_developer store Developer email venomreborn@gmail.com, no developer name, no business website — Reputation floor 7.5.
• privacy_policy_generic_google store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) → Privacy pillar 10.0.
• host_permissions_all_urls manifest <all_urls> with scripting permission enables full page read/inject on every site.
• ai_external_host_openrouter crx Extension contacts openrouter.ai — an LLM API aggregator; page content may be sent to third-party AI models.
• external_host_tinyurl crx tinyurl.com contact introduces opaque redirect; destination unknown and unauditable.
• dom_xss_sinks crx innerHTML used on user-controlled variables in panel.js and modules/utils.js — DOM-XSS risk.
• small_install_high_perm api Only 31 installs but carries <all_urls> + scripting — tail attack surface flag triggered.
• js_external_hosts_count crx 4 distinct external JS hosts: docs.orama.com, openrouter.ai, tinyurl.com, www.google.com.

Permissions Breakdown

• sidePanel low Adds a side panel UI; low standalone risk.
• contextMenus low Adds right-click menu entries; no data access.
• storage low Local extension storage; limited risk.
• activeTab medium Transient access to current tab on user gesture.
• scripting medium Can inject scripts into pages; elevated risk paired with <all_urls>.
• <all_urls> high Broad host access enables scripting/data read across every site visited.

Pillar Scores

Bookkeeping