Top Risks

• Privacy policy is Google's generic policy (myaccount.google.com) — not scoped to this extension, admits data collection and 3rd-party sharing.
• No CSP declared on MV3 extension; innerHTML DOM-XSS sink in popup.js without CSP protection.
• Uninstall URL hijack detected — extension calls chrome.runtime.setUninstallURL() to a 3rd-party target.
• last_updated is missing — maintenance posture cannot be assessed.
• developer_name field is empty; identity relies solely on email domain stefanxo.com.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar +10.0.
• uninstall_url_hijack crx uninstall_url_hijack=true; target not captured. Webstore +3.0 per rubric.
• dom_sink_innerhtml_userctrl crx innerHTML sink in popup.js; no CSP present → Code Quality +2.0 (FIX B condition met: csp_present=false).
• no_csp_mv3 manifest content_security_policy is null; MV3 has strict default but no explicit CSP amplifies innerHTML risk.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; Reputation floor 2.0 applied.
• last_updated_missing store last_updated empty and months_since_update null; maintenance scored 0.0 (cannot penalize without data).
• high_install_popular store 200,000 installs; Webstore +1.0 (>10K) +1.0 (>100K). Rating 4.7 no negative reviews.
• js_external_hosts crx External JS hosts fb.me and reactjs.org (React CDN links); 2 distinct domains, Network +1.5 (>3 threshold not met, counted as base).

Permissions Breakdown

• tabs medium Core function for tab manager; exposes tab URLs and titles.
• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Persists user settings locally; minimal risk.
• favicon low Reads tab favicons for display; low risk.

Pillar Scores

Bookkeeping