Top Risks

• <all_urls> host + content_scripts on every site from unverified free-webmail developer with generic dev name.
• Developer identity is weak: gmail address, name 'Extensions', no verified publisher badge.
• Privacy policy hosted on free Google Sites with no retention disclosure — scope_extension true but retention false.
• No CSP declared (MV3 so no +2.0 network penalty, but no CSP still removes a defensive layer).
• Low install count (3k) with high-tier host permission raises tail-attack-surface concern for future monetisation.

Evidence

• broad_host_access manifest host_permissions and content_scripts_matches both set to <all_urls>; extension can read/modify every page.
• free_webmail_developer store Developer email saniamirza697@gmail.com; developer name is generic 'Extensions'; no business domain.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust signals from Google.
• privacy_policy_free_hosting store Privacy policy on sites.google.com (free hosting); retention not disclosed; third_party_silence=true.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• clean_code_scan crx code_findings_raw empty; obfuscation_score=0.0; 3 JS files scanned — no detected malicious patterns.
• maintenance_6_12mo store months_since_update=11; falls in 6-12 month stale band (+3.5).
• no_cve_no_bad_hosts crx cve_findings_raw empty; threat_intel bad_host_hits and monetization_hits both empty.

Permissions Breakdown

• activeTab low Grants access only to the currently active tab on user gesture; limited scope.
• <all_urls> (host_permissions) high Broad host access enables content script injection on every site the user visits.
• <all_urls> (content_scripts_matches) high Content scripts run on all URLs; combined with host_permissions maximises reach.

Pillar Scores

Bookkeeping