Top Risks

• <all_urls> host permission + content script on every page enables broad data access.
• Developer email is numbered-alias qq.com account with no verified business identity.
• Privacy policy too short (17 chars) and scope_extension=false — effectively no scoped policy.
• declarativeNetRequest + <all_urls> can silently redirect or block network traffic.
• DOM innerHTML sink in content.js without CSP creates XSS risk on every page visited.

Evidence

• host_permission_all_urls manifest host_permissions: ["<all_urls>"] with content_scripts also on <all_urls> — full page access on every site.
• developer_email_qq_alias store Email 474868678@qq.com is a numbered free-webmail alias; qq.com flagged looks_throwaway=true.
• privacy_policy_inadequate api Policy fetched but length=17 chars, scope_extension=false, data_collection=false — not a real policy.
• no_developer_name store developer_name is empty string; no identifiable publisher beyond email.
• dom_xss_sink crx js/content.js uses innerHTML with variable input and no CSP; DOM-XSS risk on all pages.
• no_csp manifest content_security_policy is null; no CSP protection for MV3 extension.
• stale_15mo store Last updated March 7, 2025 — 15 months ago; falls in 12-24mo stale band.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; 9K installs with HIGH-tier host permission.

Permissions Breakdown

• storage low Stores extension preferences locally; low standalone risk.
• declarativeNetRequest medium Can modify/block network requests; paired with <all_urls> increases scope.
• <all_urls> (host_permission) high Content script injected on every site; broad read/write access to all page content.

Pillar Scores

Bookkeeping