Top Risks

• Privacy policy is unscoped to this extension yet explicitly admits data collection and third-party sharing — worst-case policy signal.
• Content scripts injected into <all_urls> with no CSP; four innerHTML DOM-XSS sinks across bundled React code heighten XSS exposure.
• Rating of 2.3 signals user dissatisfaction; no developer name listed reduces accountability.
• External JS hosts include feross.org, github.com, getbootstrap.com, reactjs.org — 4 non-dev domains raise supply-chain risk.
• react@16.13.1 bundled (below 16.4 threshold for CVE amplifier scope, but no CSP to mitigate DOM sinks in aging library).

Evidence

• privacy_policy_unscoped_admits_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy per v3.5(D).
• content_scripts_all_urls_no_csp manifest content_scripts_matches includes <all_urls>; csp_present=false. MV3 default CSP applies but no explicit extension CSP declared.
• dom_sink_innerhtml_4_files crx dom_sink_innerhtml_userctrl found in 4 JS files; csp_present=false triggers +2.0 per FIX B each occurrence (capped).
• external_hosts_non_dev crx feross.org, getbootstrap.com, github.com, reactjs.org are non-developer domains; supply-chain exposure.
• verified_publisher store verified_publisher=true; -3.0 reputation discount applied; domain resolves, no monetization hits — no 0c cap triggered.
• low_rating store Rating 2.3; rating_count not supplied so +1.0 threshold (>=50) not confirmed — not applied.
• no_developer_name store developer_name is empty string — +1.0 reputation penalty for missing 'Offered by'.
• react_16_13_1_bundled crx react@16.13.1 detected; no CVEs in cve_findings_raw so CVE pillar stays 0. Below 16.4 noted for context.

Permissions Breakdown

• tabs medium Can read tab URLs and titles across browser session.
• activeTab low Limited to currently active tab on user gesture.
• storage low Local config/state storage; no cross-origin risk alone.
• alarms low Scheduling only; low standalone risk.
• webNavigation medium Observes all navigation events; broad browsing visibility.
• history medium Full browsing history read access; sensitive user data.
• content_scripts:<all_urls> high Injects JS into every page; broadest possible content access.

Pillar Scores

Bookkeeping