Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Word Replacer Max: Auto Text Swapper [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail developer (gmail) with generic name 'ChromeExtensions' — low accountability.
• Privacy policy hosted on free Google Sites with no retention clause disclosed.
• Content script injected on all URLs gives page-level DOM read/write access.
• Only 22 installs with no ratings — unproven, minimal community vetting.

Evidence

• developer_email_free_webmail store Developer email binderpo343@gmail.com — free webmail, no verified business domain.
• generic_developer_name store Developer name 'ChromeExtensions' is generic; no verified publisher badge.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; extension can read/modify DOM on every site.
• privacy_policy_free_hosting_no_retention api Policy on sites.google.com; scope_extension=true, data_collection=true, retention=false, third_party_silence=true.
• very_low_installs store Only 22 installs; no community validation available.
• no_cve_findings crx cve_findings_raw is empty; no known vulnerable libraries detected.
• no_code_findings crx code_findings_raw is empty; obfuscation_score=0.0; no exfil or eval patterns found.
• no_threat_intel_hits api bad_host_hits, monetization_hits, affiliate_hits all empty; no external JS hosts.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Word Replacer Max: Auto Text Swapper [data-theft] + malext.io malicious_extension_sentry; score 2.41 -> 4.91 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores replacement rules locally; expected for this extension type.
• content_scripts <all_urls> medium Content script runs on every site, can read/modify page DOM — medium risk but matches stated word-replace function.

Pillar Scores

Bookkeeping