Top Risks

• Privacy policy is Google's generic account policy — not scoped to OneTab; data handling for this extension is undisclosed.
• Developer name is blank; no verified publisher badge despite 2M installs.
• tabs permission exposes URLs and titles of all open tabs.
• Privacy policy admits data collection and third-party sharing but not scoped to this extension (v3.5 rule D: +10.0 privacy).
• No host permissions or broad content_scripts, but tab URL data collected locally has no disclosed retention policy.

Evidence

• privacy_policy_generic store Policy URL is Google's global account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• no_developer_name manifest developer_name is empty string; no verified publisher badge → +1.0 reputation.
• featured_by_google store is_featured_by_google=true applies -2.0 reputation discount.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, no eval/fetch/exfil indicators.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• threat_intel_clean api bad_host_hits, affiliate_hits, monetization_hits all empty; developer domain resolves, not throwaway.
• high_install_popular store 2M installs, rating 4.5; +1.0+1.0+0.5 webstore installs, -0.5 popularity trust discount.
• js_external_hosts crx Only external JS host is www.one-tab.com (dev-controlled); CSP restricts script-src to self.

Permissions Breakdown

• favicon low Reads page favicons for tab display; low sensitivity.
• unlimitedStorage low Allows large local storage; no data exfil risk alone.
• storage low Standard local/sync storage for tab list persistence.
• tabs medium Can read tab URLs and titles across all open tabs.
• activeTab low Scoped to current tab on user action; limited blast radius.
• scripting medium Can inject scripts into pages; paired with activeTab limits scope.
• contextMenus low Adds right-click menu items; UI-only, no data access.

Pillar Scores

Bookkeeping