Top Risks

• Facebook session exposure: cookies + DNR+HostAccess + websockets to FB edge-chat
• Free-gmail developer with no verified business identity
• Targeted facebook.com host access enables account-scoped data interception
• Rating 3.1 with unknown review count; middling trust
• 6+ months since last update

Evidence

• cookies+DNRWithHostAccess+fb-websockets manifest cookies, declarativeNetRequestWithHostAccess, wss://edge-chat.facebook.com; broad session access to FB
• free-webmail-dev store junookyo@gmail.com, no verified publisher badge
• privacy-policy api Scoped policy with collection/purpose/retention; mentions third-party sharing
• months_since_update=7 store Last updated March 2026, 7 months stale
• install_count=10000 store 10K installs; modest reach
• rating=3.1 store Below-average rating
• no-cve-findings crx cve_findings_raw empty
• no-code-findings crx code_findings_raw empty; obfuscation_score 0.0

Permissions Breakdown

• cookies high Read/write cookies on facebook.com; can steal session tokens
• downloads medium Can download media/files from Facebook to local disk
• storage low Extension-local storage
• offscreen low Offscreen documents; can host hidden processing
• declarativeNetRequest medium Can block/modify network requests
• declarativeNetRequestWithHostAccess high Full request manipulation on matched hosts

Pillar Scores

Bookkeeping