Top Risks

• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — scores maximum privacy risk.
• Brand impersonation: extension mentions 'Amazon' without being an Amazon product; not verified owner.
• Extension stale 36 months with broad <all_urls> host access and content scripts on every page.
• Install-time URL hijack: onInstalled redirects user to https://productsearch.app/visual-search (3rd-party).
• No CSP on MV3 extension with 5 external JS hosts including apiheaven.io; network surface uncontrolled.

Evidence

• privacy_policy_scope_mismatch api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → D rule: +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false, brands=[amazon]; verified+featured → +1.0 reputation.
• install_url_hijack crx install_url_hijack=true, target=https://productsearch.app/visual-search; +2.0 webstore (install redirect).
• staleness store months_since_update=36; maintenance pillar = 8.5. v2 calibration 0c caps publisher discount at -1.0.
• external_js_hosts crx 5 external hosts: apiheaven.io, jquery.com, jquery.org, js.foundation, productsearch.app, sizzlejs.com; no CSP.
• broad_host_access manifest host_permissions=[http://*/,https://*/] + content_scripts <all_urls>; scripting permission on all sites.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty.
• verified_publisher_featured store verified_publisher=true, is_featured_by_google=true; discounts capped at -1.0 due to staleness >18mo.

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Extends storage quota; minimal additional risk.
• contextMenus low Adds right-click menu items; expected for image-search function.
• scripting medium Allows programmatic script injection into pages; elevated with broad host access.
• tabs medium Can read URLs and titles of open tabs; moderate privacy exposure.
• http://*/ high Broad host permission covering all HTTP sites; pairs with scripting for full page access.
• https://*/ high Broad host permission covering all HTTPS sites; same concern as http.
• <all_urls> (content_scripts) high Content script injected into every page the user visits.

Pillar Scores

Bookkeeping