Top Risks

• Developer domain adblock-for-youtube.com does not resolve — no accountable entity behind 11M-install extension.
• Privacy policy hosted on Google Sites (free hosting), lacks data retention disclosure; third-party sharing unaddressed.
• install_url_hijack and uninstall_url_hijack flags set — extension intercepts install/uninstall lifecycle events.
• webRequest + scripting + <all_urls> without CSP gives broad capability to observe and modify all web traffic.
• innerHTML DOM-XSS sink in contentscript.js with no CSP, elevating exploitability if content is attacker-controlled.

Evidence

• developer_domain_not_resolving api adblock-for-youtube.com does not resolve; no verifiable business entity behind 11M installs.
• install_uninstall_url_hijack crx install_url_hijack=true and uninstall_url_hijack=true; lifecycle interception detected.
• no_csp manifest content_security_policy is null on MV3 extension with DOM-sink finding.
• privacy_policy_free_hosting store Policy on sites.google.com; scope_extension=true but retention=false and third_party_silence=true.
• dom_xss_sink crx contentscript.js: configurablePopup.innerHTML = html — user-controlled DOM sink, no CSP mitigant.
• broad_host_permissions manifest host_permissions=[<all_urls>] + content_scripts on http/https://*/* — full site reach.
• is_featured_by_google store Google Featured badge present; provides partial trust signal.
• js_external_hosts crx Contacts fonts.googleapis.com and get.adblock-for-youtube.com; latter domain does not resolve.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata across all sites.
• storage low Local config persistence; low direct risk.
• unlimitedStorage low Extends storage quota; no data-exfil risk alone.
• scripting high Injects JS into any page via host_permissions <all_urls>.
• alarms low Background scheduling; minimal risk.
• declarativeNetRequest medium Blocks/modifies network requests; core ad-block function.
• webNavigation medium Monitors all navigation events across all tabs.
• webRequest high Observes all HTTP requests; broad traffic visibility.
• <all_urls> high Host permission grants access to every site the user visits.

Pillar Scores

Scoring History

Bookkeeping