Top Risks

• Privacy policy admits data collection and third-party sharing without scoping to this extension — scores maximum privacy risk.
• Content scripts + host_permissions on <all_urls>: runs on every page the user visits with scripting capability.
• No CSP + innerHTML DOM-XSS sink: any XSS in bundled React code can exfiltrate page content across all origins.
• Free-webmail developer (gmail) with no developer name listed; low accountability.
• new Function() constructor in popup.js is a dynamic code execution risk even without obfuscation.

Evidence

• privacy_policy_scope_mismatch api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy (D rule).
• host_permissions_all_urls_plus_scripting manifest <all_urls> host permission combined with scripting and content_scripts on all URLs.
• no_csp crx content_security_policy is null; no CSP present, raising DOM-sink risk.
• free_webmail_dev_no_name store developer_email=colorpicker08@gmail.com, developer_name empty; free-webmail + no name.
• dom_sink_innerhtml_no_csp crx innerHTML DOM-XSS sink in 257.js with csp_present==false triggers +2.0 code quality (FIX B).
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; reduces reputation risk.
• install_count_large_reach store 700,000 installs; broad reach amplifies any data collection or XSS risk.
• function_constructor_popup crx new Function() in popup.js is a dynamic code execution vector (+2.5 code quality).

Permissions Breakdown

• storage low Stores user settings locally; low risk.
• activeTab medium Access to current tab on user action; scoped but enables page reads.
• background low Keeps service worker alive; no direct data access.
• scripting medium Can inject scripts into pages; elevated when paired with <all_urls>.
• <all_urls> (host_permissions) high Broad host access across every site; pairs with scripting for full page injection.
• <all_urls> (content_scripts) high Content scripts run on every page visited; persistent broad reach.

Pillar Scores

Bookkeeping