Top Risks

• Privacy policy fetched but scope_extension==false AND data_collection+third_party_sharing both true → worst-case generic policy admitting broad sharing.
• Free-webmail developer (gmail) with no verified publisher status raises accountability concerns.
• <all_urls> host permission grants read access to every page the user visits.
• Description promises blocking but lacks declarativeNetRequest/webRequest — capability mismatch raises shell-pattern suspicion.
• Small install base (443) with high-tier host permission flags tail-attack-surface risk.

Evidence

• privacy_policy_generic_broad_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D rule applies: +10.0 privacy.
• free_webmail_developer store Developer email xquitapp@gmail.com; no verified publisher; reputation pillar elevated.
• host_permission_all_urls manifest <all_urls> grants access to every site; paired with webNavigation enables full browsing surveillance.
• description_promise_mismatch store Promises blocking but lacks declarativeNetRequest/webRequest; +2.0 webstore.
• install_perm_anomaly api 443 installs + high-tier permission (all_urls); small_install_high_perm=true → +1.5 webstore.
• no_csp manifest csp_present=false on MV3; MV3 has strict default so no +2.0 network penalty applies.
• no_code_findings crx 9 JS files scanned; obfuscation_score=0.0; code_findings_raw empty → code quality 0.0.
• wayback_no_ownership_change api Wayback check completed; ownership_changed=false; no additional penalty.

Permissions Breakdown

• storage low Stores user settings locally; minimal risk.
• webNavigation medium Observes all navigation events across all URLs; needed for blocking but broad.
• <all_urls> (host_permission) high Full access to every page the user visits; paired with webNavigation enables comprehensive monitoring.

Pillar Scores

Bookkeeping