Top Risks

• Privacy policy is Google's generic account policy — does NOT scope to this extension; admits data collection and third-party sharing.
• Content scripts inject on ALL http/https pages; dynamic <script> creation in injected.js with no CSP allows runtime remote code loading.
• No CSP + dynamic script injection + innerHTML sink = elevated DOM-XSS / remote-code risk for an extension touching all user pages.
• Developer is Microsoft but not verified publisher; low 2.8 rating raises user-experience concerns.
• js_external_hosts include go.apollo.dev (third-party) contacted from a broad-reach extension with no CSP guard.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension. scope_extension=false, data_collection=true, third_party_sharing=true.
• content_scripts_all_urls manifest content_scripts_matches: http://*/* and https://*/* — injected.js runs on every page the user visits.
• no_csp manifest content_security_policy is null; MV3 default applies but dynamic script creation in injected.js bypasses intent.
• script_src_dynamic crx injected.js dynamically creates <script> elements — potential for remote code loading at runtime.
• dom_sink_innerhtml crx popup.js assigns innerHTML from a variable with no CSP guard — DOM-XSS sink present.
• external_hosts crx js_external_hosts: clarity.microsoft.com, github.com, go.apollo.dev, reactjs.org — 4 distinct domains including third-party go.apollo.dev.
• low_rating store Rating 2.8 for a Microsoft-branded tool with 90,000 installs; no review red flags matched.
• developer_identity store Developer: Microsoft Corporation, microsoft.com resolves, not throwaway, not verified publisher in store listing.

Permissions Breakdown

• tabs medium Can read tab URLs/titles; combined with content scripts on all URLs raises passive surveillance risk.
• storage low Local storage for settings; low impact on its own.
• content_scripts http://*/* https://*/* high Runs injected.js on every page the user visits — broad reach, enables DOM reading/manipulation.

Pillar Scores

Bookkeeping