Top Risks

• Brand impersonation: extension uses Perplexity name/brand but developer is unaffiliated gmail user.
• Privacy policy is Google's own generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Content script declared on <all_urls> grants DOM access to every page despite minimal declared permissions.
• Install URL hijack opens onboarding.html on install — minor but indicative of engagement-funnel behavior.
• Free-webmail developer (gmail), no business identity, no verified publisher; stale 20 months.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false; developer is gmail user 'vaeho', not Perplexity AI.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• content_scripts_all_urls manifest content_scripts_matches=["<all_urls>"] — injected on every site despite only activeTab/storage/contextMenus declared.
• install_url_hijack crx install_url_hijack=true, target=onboarding.html (internal page, not 3rd-party redirect).
• free_webmail_developer store developer_email=vvakhtangishvili7@gmail.com; no business domain; no verified publisher badge.
• maintenance_stale store last_updated=October 20, 2024; months_since_update=20; falls in 12-24mo stale band.
• no_csp manifest content_security_policy=null on MV3 extension; no explicit CSP hardening.
• cve_findings crx cve_findings_raw=[]; no known CVEs in bundled libraries.

Permissions Breakdown

• activeTab low Grants access to the current tab only on user action; limited scope.
• storage low Local key-value storage; no network exfil on its own.
• contextMenus low Adds right-click menu items; low intrinsic risk.
• content_scripts:<all_urls> high Content script injected on every page; broad read/write DOM access despite narrow declared permissions.

Pillar Scores

Bookkeeping