Top Risks

• Google's generic privacy policy does not scope data collection to this extension — privacy pillar maxed.
• webRequest + scripting + <all_urls> gives broad capability to observe/inject on every site.
• innerHTML user-controlled DOM sink in reader-compiled.js is a potential XSS vector.
• new Function() in bundled pdf.js/pdf.worker (PDF.js pattern) — capability-gate check, but eval-capable.
• install_url_hijack opens scholar.google.com on install — low-severity but noted.

Evidence

• recognized_google_developer store developer_email=scholar-chrome-extensions@google.com; domain=google.com; brand_mention.confirmed_owner=true; is_featured_by_google=true.
• generic_privacy_policy api policies.google.com/privacy: scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) +10.0 privacy.
• broad_host_permissions manifest host_permissions=[<all_urls>] plus content_scripts on <all_urls>; webRequest and scripting amplify reach.
• dom_xss_sink crx reader-compiled.js: innerHTML assigned from variable; CSP present (MV3 strict) reduces but doesn't eliminate risk.
• function_constructor_pdf_js crx pdf.min.js and pdf.worker.min.js use new Function() for isEvalSupported detection — standard PDF.js pattern.
• no_cve_findings api cve_findings_raw=[]; no known-bad hosts; no monetization/affiliate hits.
• install_url_hijack store onInstalled opens https://scholar.google.com/scholar/reader-install.pdf — Google-owned destination, low risk.
• csp_present_mv3 manifest extension_pages CSP: script-src 'self'; no unsafe-eval/inline; MV3 strict defaults apply.

Permissions Breakdown

• webNavigation medium Allows observing navigation events across all URLs; passive but broad.
• webRequest high Intercept/observe all HTTP requests; HIGH-impact capability.
• declarativeNetRequest medium Can block/redirect network requests; powerful but declarative.
• scripting high Can inject scripts into pages; combined with <all_urls> this is broad reach.
• storage low Local extension storage; low direct risk.
• offscreen low Off-screen document for background PDF rendering; low direct risk.
• clipboardWrite medium Can write to clipboard; limited to write-only.
• <all_urls> (host_permission) high Broadest host access; content_scripts also match <all_urls>, amplifying scripting+webRequest.

Pillar Scores

Scoring History

Bookkeeping