Top Risks

• Developer uses free webmail (gmail) with no verified business identity and no listed developer name.
• Privacy policy does not scope to this extension (scope_extension=false) and has no retention disclosure.
• No CSP declared (MV3 mitigates but still absent); scripting permission allows tab-level code injection.
• Very low install count (559) limits reputation signal; extension largely unvetted by community.
• Privacy policy page is on a personal/small-business domain without explicit extension data collection disclosure.

Evidence

• free_webmail_dev store Developer email superdwayne@gmail.com; no verified business website; developer_name empty.
• privacy_policy_scope_missing api Policy fetched but scope_extension=false, data_collection=false, retention=false → +9.0 privacy.
• no_csp manifest content_security_policy is null; MV3 provides some default protection.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty — no malicious signals.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• low_installs store 559 installs; below community-vetting threshold.
• maintenance_recent store Last updated January 20, 2026; 5 months ago — active maintenance.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; developer_domain_info null.

Permissions Breakdown

• activeTab low Only accesses current tab on user action; narrow scope.
• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local preference storage; no exfil risk alone.
• scripting medium Can inject scripts into active tab; combined with activeTab limits scope but still capable.

Pillar Scores

Bookkeeping