Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• cookies permission scoped to bilibili.com/biliplus.com; could read session tokens if site visited.
• Uninstall URL hijack flag set — redirects user on uninstall to unknown target.
• innerHTML DOM-XSS sink in Vue bundle; CSP present mitigates but sink still exists.
• No developer name listed; identity accountability reduced despite verified publisher badge.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true with null target; triggers +3.0 Webstore per rubric.
• cookies_permission_scoped manifest cookies declared; host_permissions limited to bilibili.com/biliplus.com — high but scoped.
• dom_sink_innerhtml crx innerHTML write in styles bundle; CSP present (csp_present=true) so FIX B condition partially met → +0.5.
• verified_publisher store Verified publisher badge present; -3.0 Reputation; no HIGH-capability gate triggered (no broad all_urls/webRequest/debugger).
• no_developer_name store developer_name is empty string; +1.0 Reputation penalty applied.
• js_external_host_vuejs crx js_external_hosts=[vuejs.org]; reference only, no bad-host hit, no CSP remote CDN issue.
• cve_none crx cve_findings_raw empty; CVE pillar = 0.0.

Permissions Breakdown

• tabs medium Can read tab URLs and titles across browser.
• storage low Local data persistence; low standalone risk.
• activeTab low Scoped to user-activated tab only.
• cookies high Can read/write cookies; scoped to bilibili.com/biliplus.com but sensitive.
• alarms low Scheduling only, no data access.
• scripting medium Programmatic script injection into pages; combined with host perms is significant.
• *://*.bilibili.com/* medium Broad access to bilibili.com; matches stated purpose.
• *://bilibili.com/* low Apex domain access; redundant with wildcard subdomain.
• *://*.biliplus.com/* medium Third-party companion site to bilibili; access to cookies here is notable.

Pillar Scores

Bookkeeping