Top Risks

• Privacy policy admits data collection and third-party sharing without scoping to this extension — worst-case privacy posture.
• Content script runs on *://*/* giving full DOM access on every site despite only one host_permission backend.
• No CSP declared; three innerHTML sinks across newtab, options, and panel bundles elevate DOM-XSS risk (FIX B).
• Extension is stale (20 months); v3.5 invariant 0c caps verified-publisher discount to -1.0 due to staleness.
• AI extension processes page content — elevated exfil concern given broad content-script scope.

Evidence

• content_scripts_broad manifest content_scripts_matches = ['*://*/*'] — runs on every site despite narrow host_permissions backend.
• privacy_policy_admits_data_and_3p_sharing_no_scope crx fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0 per v3.5 rule D.
• no_csp manifest content_security_policy=null; three innerHTML sinks present → FIX B applies (+2.0 code quality).
• dom_xss_sinks crx dom_sink_innerhtml_userctrl in newtab.bundle.js, options.bundle.js, panel.bundle.js.
• stale_extension store months_since_update=20; maintenance pillar +6.0 (6-12mo bracket would be 3.5, 12-24mo = 6.0).
• verified_publisher_discount_capped store verified_publisher=true but months_since_update=20 >18 → discount capped at -1.0 per v3.5 invariant 0c.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty applied.
• ai_page_content_processing store AI spell-checker with *://*/* content scripts sends content to checktypo.com backend.

Permissions Breakdown

• identity low OAuth token access only; low impact without scopes.
• content_scripts *://*/* high Runs JS on every page the user visits — full DOM read/write across all sites.
• host_permissions: https://checktypo.com/* low Scoped to developer's own backend; narrow.

Pillar Scores

Bookkeeping