Top Risks

• manifest_source is html_fallback — no CRX permissions or code could be inspected; actual capability unknown.
• Developer name field empty; reputation relies solely on email domain adblockplus.org.
• Privacy policy confirms third-party data sharing; retention disclosed but sharing present.
• Description-promise mismatch: claims ad-blocking but no webRequest/declarativeNetRequest observed (html_fallback limitation).
• 39M installs creates large blast radius if extension ever compromised or transferred.

Evidence

• manifest_source_html_fallback store Manifest parsed from HTML fallback — permissions, host_permissions, content_scripts all unobservable; scoring conservative.
• featured_by_google store Extension carries 'Featured' badge from Google Web Store, indicating editorial vetting.
• no_bad_hosts_no_affiliate_no_monetization api threat_intel shows empty bad_host_hits, affiliate_hits, and monetization_hits.
• no_cve_findings crx cve_findings_raw is empty; no vulnerable bundled libraries detected.
• privacy_policy_third_party_sharing api privacy_policy_classification: fetched, scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• description_promise_mismatch store description_promise.mismatches: 'promises ad-blocking but lacks declarativeNetRequest/webRequest' — likely html_fallback artifact.
• developer_domain_resolves api adblockplus.org resolves, looks_throwaway=false, established brand in ad-blocking space.
• high_install_count store 39M installs; blast radius is very large if extension integrity ever compromised.

Pillar Scores

Scoring History

Bookkeeping