Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, yet discloses data collection and third-party sharing (Privacy pillar: 10.0).
• Developer uses free Gmail address (jjkapp2020@gmail.com) with no verifiable business identity, elevating Reputation risk.
• Four innerHTML DOM-XSS sinks across multiple JS files with no CSP; amplified risk from csp_present==false.
• External host wapdf.newappzone.com is an unverified third-party domain embedded in content_scripts and js_external_hosts.
• Content scripts inject into all http/https PDF URLs (broad host coverage) despite minimal declared permissions.

Evidence

• free_webmail_dev_email store Developer email jjkapp2020@gmail.com — Gmail, no verified business domain.
• generic_privacy_policy store Privacy policy points to Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sinks_no_csp crx 4 innerHTML DOM-XSS sinks in open.js, option.js, webpage1.js, popup.js; csp_present=false amplifies risk.
• external_third_party_host crx wapdf.newappzone.com appears in content_scripts_matches and js_external_hosts — unverified third-party domain.
• broad_content_script_pdf manifest Content scripts match http/https://*/*.pdf* and file://*/*.PDF* — covers all PDF-like URLs on all sites.
• mv3_no_csp manifest MV3 extension has no explicit CSP declared; DOM sinks lack mitigation.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust badge.
• operator_cluster_dev_email_count api operator_cluster sibling_count=0 but dev_email dimension=1; single identity cluster, limited blast radius.

Permissions Breakdown

• storage low Stores user preferences; minimal risk.
• contextMenus low Adds right-click menu items; low capability.
• content_scripts(*://wapdf.newappzone.com/*, file://*/*.pdf*, http://*/*.pdf*, https://*/*.pdf*) medium Broad file:// and http(s):// PDF URL access injects scripts into all PDF pages across all sites.

Pillar Scores

Bookkeeping