Top Risks

• Content script injected on all URLs (<all_urls>) gives broad page-level access on every site visited.
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail.com), no verified publisher, no business domain — low accountability.
• Extension not updated in ~23 months; approaching zombie status with high-reach permissions.
• Small install count (201) combined with HIGH-tier host permissions flags tail-attack-surface risk.

Evidence

• broad_host_access manifest host_permissions includes *://*/* and <all_urls>; content_scripts_matches also <all_urls>.
• generic_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email kazkadien@gmail.com; no business domain; developer_domain_info=null.
• stale_extension store Last updated July 2024; 23 months since update with broad host permissions.
• install_perm_anomaly api small_install_high_perm=true, tail_attack_surface=true; 201 installs with <all_urls>.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts detected.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.

Permissions Breakdown

• storage low Stores extension settings locally; low risk.
• contextMenus low Adds right-click menu items; low risk.
• clipboardWrite medium Can write to clipboard; moderate risk for data injection.
• *://*/* high Broad host access; content script runs on all URLs.
• <all_urls> high Redundant broad host; content script injected into every page.

Pillar Scores

Bookkeeping