Top Risks

• Privacy policy admits data collection + 3rd-party sharing without scoping to this extension — scores maximum privacy risk.
• Instagram brand impersonation by unverified gmail developer with no confirmed ownership.
• new Function() constructor present in all 4 JS files — dynamic code execution risk across content and background scripts.
• <all_urls> host_permissions broader than content_scripts scope (instagram.com only) — scope mismatch amplifier.
• Free-webmail developer (gmail) with no developer name listed and unverified brand ownership.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer is gmail user dc77meza, confirmed_owner=false.
• privacy_policy_admits_collection_and_sharing api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → D rule: +10.0.
• function_constructor_all_files crx new Function() found in background.js, content-sidebar.js, instagram-content.js, newtab-app.js.
• host_permissions_all_urls manifest <all_urls> host_permissions while content_scripts scoped only to instagram.com — scope mismatch.
• free_webmail_developer store Developer email dc77meza@gmail.com; no developer name provided; no verified business domain.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension.
• verified_publisher store verified_publisher=true provides partial trust signal but does not override impersonation or privacy risk.
• maintenance store months_since_update=11; falls in 6-12mo band (+3.5).

Permissions Breakdown

• storage low Stores local extension state; low exfil risk alone.
• tabs medium Can read tab URLs and titles across all open tabs.
• downloads medium Can trigger arbitrary file downloads to user's machine.
• sidePanel low UI surface only; no data-access risk on its own.
• declarativeNetRequest medium Can rewrite/block network requests without seeing content.
• <all_urls> high Broad host access; content scripts only narrow to instagram.com but host_permissions is unrestricted.

Pillar Scores

Bookkeeping