Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Developer uses free webmail (gmail) with no verified business domain; low accountability.
• DOM innerHTML sink present in JS bundle with no CSP; potential XSS vector.
• No ratings or user reviews; very low install base limits reputation signal.
• No CSP defined (MV3 default enforced, but content_security_policy field is null).

Evidence

• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Developer email luson009@gmail.com; free webmail, no business domain; reputation +1.5.
• dom_sink_innerhtml crx innerHTML assigned from variable in MultiLanguageEditor bundle; no CSP → code quality +2.0.
• no_csp manifest content_security_policy is null; csp_present=false; amplifies DOM-sink risk.
• external_js_hosts crx js_external_hosts: github.com, reactjs.org — 2 distinct domains, likely doc/reference links not active script load.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable bundled libraries detected.
• maintenance_3_6mo store months_since_update=9; falls in 6-12mo band → +3.5 maintenance.
• operator_cluster_clean api sibling_count=0; no related malicious extensions under same fingerprint.

Permissions Breakdown

• storage low Stores local extension data; no cross-origin or user-data exfil risk on its own.

Pillar Scores

Bookkeeping