Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cold Messenger [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail developer (gmail) with no business website or verified identity raises accountability concerns.
• No developer name listed in store; anonymous publisher reduces governance assurance.
• Only 5 installs with no ratings; zero community validation of behaviour.
• Privacy policy hosted on free Firebase hosting; scope and retention are disclosed but developer identity unverifiable.

Evidence

• free_webmail_developer store Developer email adeelghauri9965@gmail.com; no business domain; no verified publisher badge.
• no_developer_name store developer_name is empty string; anonymous publisher.
• narrow_host_permissions manifest Host permissions and content_scripts limited to https://my.quo.com/*; low blast radius.
• no_code_findings crx code_findings_raw is empty; obfuscation_score 0.0; 8 JS files scanned.
• no_cve_findings crx cve_findings_raw empty; no known-bad-host hits.
• privacy_policy_adequate api Policy fetched; scope_extension, data_collection, retention, third_party_sharing all true; no third_party_silence.
• very_low_installs store Only 5 installs; zero ratings; no community validation.
• recently_updated store Last updated July 4, 2026; 1 month ago; maintenance risk zero.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cold Messenger [data-theft] + malext.io malicious_extension_sentry; score 2.41 -> 4.91 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local data persistence; low inherent risk.
• scripting medium Can inject scripts into pages; scoped to my.quo.com only.
• notifications low Desktop notifications; limited abuse surface.
• offscreen low Off-screen document for background tasks; low risk in isolation.
• https://my.quo.com/* low Narrow host permission scoped to single domain; matches stated function.

Pillar Scores

Bookkeeping