Top Risks

• Privacy policy is Google's generic policy (not scoped to this extension) and admits data collection + third-party sharing.
• Content script injected on <all_urls> gives extension reach into every page the user visits.
• new Function() constructor found in bundled JS — dynamic code execution risk.
• innerHTML sink on variable input (DOM-XSS) in content-facing bundle.
• Developer uses free Gmail address with no verifiable business identity.

Evidence

• content_scripts broad host manifest content_scripts_matches=["<all_urls>"] — runs on every site despite only needing devtools context.
• privacy policy generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor code finding crx new Function('return this') in main bundle — dynamic code execution pathway.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in React-dom; CSP present but sink still exploitable via controlled input.
• free webmail developer store Developer email txitxo37+chromewebstore@gmail.com; no business domain; unverified identity.
• js_external_hosts crx External JS hosts: fb.me, reactjs.org — error-boundary CDN references, no bad-host hits.
• react 16.13.1 detected crx react@16.13.1 detected via license sidecar; version unknown for CVE scan but no CVEs flagged.
• no verified publisher store verified_publisher=false, is_featured_by_google=false, operator sibling_count=0.

Permissions Breakdown

• storage low Stores local extension state only; no cross-origin data risk.
• content_scripts:<all_urls> high Content script runs on every page; broad reach even without explicit host_permissions.

Pillar Scores

Bookkeeping