Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• cookies permission scoped to bilibili.com/biliplus.com; could read session tokens if site visited.
• Uninstall URL hijack flag set — redirects user on uninstall to unknown target.
• innerHTML DOM-XSS sink in Vue bundle; CSP present mitigates but sink still exists.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true with null target; triggers +3.0 Webstore per rubric.
• cookies_permission_scoped manifest cookies declared; host_permissions limited to bilibili.com/biliplus.com — high but scoped.
• dom_sink_innerhtml crx innerHTML write in styles bundle; CSP present (csp_present=true) so FIX B condition partially met → +0.5.
• verified_publisher store Verified publisher badge present; -3.0 Reputation; no HIGH-capability gate triggered (no broad all_urls/webRequest/debugger).
• no_developer_name store developer_name is empty string; +1.0 Reputation penalty applied.
• js_external_host_vuejs crx js_external_hosts=[vuejs.org]; reference only, no bad-host hit, no CSP remote CDN issue.
• cve_none crx cve_findings_raw empty; CVE pillar = 0.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry; score 3.56 -> 6.06 (+2.5 cap 2.5).

Permissions Breakdown

• tabs medium Can read tab URLs and titles across browser.
• storage low Local data persistence; low standalone risk.
• activeTab low Scoped to user-activated tab only.
• cookies high Can read/write cookies; scoped to bilibili.com/biliplus.com but sensitive.
• alarms low Scheduling only, no data access.
• scripting medium Programmatic script injection into pages; combined with host perms is significant.
• *://*.bilibili.com/* medium Broad access to bilibili.com; matches stated purpose.
• *://bilibili.com/* low Apex domain access; redundant with wildcard subdomain.
• *://*.biliplus.com/* medium Third-party companion site to bilibili; access to cookies here is notable.

Pillar Scores

Bookkeeping