Top Risks

• Privacy policy is generic corporate policy (scope_extension=false) admitting data collection and third-party sharing — worst-case privacy score triggered.
• cookies + <all_urls> + webRequest combination allows broad sitewide cookie read/write and request interception.
• scripting + <all_urls> enables arbitrary JS injection on every visited page.
• No CSP present (MV3 provides some default protection but no explicit scope restriction).
• new Function() constructor in bg.js enables dynamic code execution; low obfuscation but warrants review.

Evidence

• verified_publisher + featured store Rakuten is a verified publisher with Google Featured badge; reputation floored at 2.0.
• privacy_policy_scope_mismatch api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• cookies + <all_urls> manifest HIGH permission pair; ×1.2 amplifier applied on permissions pillar.
• function_constructor in bg.js crx new Function() found; +2.5 code quality per debugger_attach/function_constructor rule.
• 7 external JS hosts crx button.rrcbsn.com, capture.ecbsn.com, cas.rrcbsn.com, search.ecbsn.com + app stores contacted.
• no bad_host_hits / affiliate_hits / monetization_hits api Threat intel clean; no ad-tech or affiliate network hits detected.
• 3M installs, rating 4.9, zero review red flags store High install count with strong rating and no malware/redirect complaints in reviews.
• justified-broad-permission discount applied manifest Shopping/cashback category matches broad host access; -1.5 discount on permissions pillar.

Permissions Breakdown

• tabs medium Can read tab URLs and titles across all navigation events.
• webNavigation medium Observes all navigation events; needed for cashback trigger detection.
• webRequest high Intercepts all HTTP requests across all URLs — high surveillance capability.
• storage low Stores extension state locally; standard low risk.
• cookies high Combined with <all_urls> allows reading/writing cookies sitewide — ×1.2 amplifier applies.
• alarms low Schedules background tasks; low standalone risk.
• scripting high Programmatic script injection into pages; paired with <all_urls> is broad capability.
• <all_urls> (host_permission) high Grants access to every origin; justified by cashback category but amplifies cookies+webRequest.

Pillar Scores

Scoring History

Bookkeeping