Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — ZAP Wallet - AI-Powered Solana Wallet [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Crypto wallet with broad <all_urls> host permissions + scripting: can read/inject into every page including banking sites.
• Gmail dev account (genograndino@gmail.com), unknown org 'TGSOC', zero installs — unverifiable identity holding sensitive private keys.
• Dynamic script creation (script_src_dynamic) and new Function() constructor detected — code execution risk even with CSP present.
• Privacy policy fetched but no retention disclosure and third_party_silence=true; inadequate for a wallet handling private keys.

Evidence

• broad_host_permissions manifest http://*/* and https://*/* granted alongside scripting — full page read/inject on all sites.
• free_webmail_developer store Developer email genograndino@gmail.com with unknown org TGSOC; no verified publisher badge.
• code_finding_function_constructor crx new Function() constructor found in popup-bundle.js — dynamic code execution capability.
• code_finding_script_src_dynamic crx Dynamic <script> element creation in popup-bundle.js — potential remote script loading.
• install_perm_anomaly store Only 4 installs with high-tier permissions (broad host access + scripting) flagged as small_install_high_perm.
• privacy_policy_inadequate api Policy fetched (1253 chars), scope_extension=true but no retention disclosure and third_party_silence=true.
• external_hosts crx Contacts api.coingecko.com, mainnet.helius-rpc.com, solscan.io, zapzip.fun — plausible for Solana wallet.
• ai_crypto_wallet_high_value_target store AI-powered Solana wallet is prime supply-chain compromise target; 4 installs with near-unrestricted page access.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — ZAP Wallet - AI-Powered Solana Wallet [credential-theft] + malext.io malicious_extension_sentry; score 5.02 -> 7.52 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local wallet/UI state; low risk alone.
• activeTab low Temporary access to active tab on user gesture only.
• scripting medium Allows programmatic JS injection into pages; elevated with broad host_permissions.
• tabs medium Can read tab URLs/titles across all tabs.
• http://*/* high Broad host access over HTTP — all sites reachable for scripting/data access.
• https://*/* high Broad host access over HTTPS — all sites reachable; pairs with scripting for full read/write.

Pillar Scores

Bookkeeping