Top Risks

• Manifest unavailable (html_fallback) despite 200K installs — permission surface unverifiable
• Privacy policy fetched but not scoped to this extension
• Free-webmail developer email (gmail.com); identity anchored only by verified-publisher badge

Evidence

• manifest_missing store manifest_source=html_fallback; permissions/host_permissions not observable; v3.5(B) +3.0 (200K installs)
• privacy_policy_generic api fetched=true, scope_extension=false, data_collection=false → +9.0 per v3 FIX A/D
• verified_publisher store verified_publisher=true → reputation -3.0, floored at 2.0 (v2 0a)
• free_webmail_dev store straybugs@gmail.com; no developer_name; domain_age_ct not queried (free webmail)
• install_base store 200,000 installs, rating 4.8 → +1.0 webstore (installs>100K); no popularity discount (<1M)
• no_cve_findings crx cve_findings_raw empty; js_libraries_detected empty → CVE pillar 0.0
• no_code_findings crx code_findings_raw empty, obfuscation 0.0, js_files_scanned 0 → code pillar 0.0
• active_maintenance store last_updated 1 month ago; review_red_flags 0; threat_intel hits all empty

Pillar Scores

Bookkeeping