Top Risks

• No developer name listed; anonymous publisher reduces accountability.
• Uninstall URL hijack detected — onUninstalled likely navigates to third-party page.
• Install URL hijack (onboarding.html) opens page on install; low severity but worth noting.
• Privacy policy admits data collection and third-party sharing; retention disclosed but scope narrow.
• No CSP defined (MV3 default mitigates somewhat, but no explicit hardening).

Evidence

• uninstall_url_hijack crx install_url_hijack=true and uninstall_url_hijack=true; onboarding.html opens on install.
• no_developer_name store developer_name is empty string; only email info@popupsblocker.org available.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• verified_publisher store verified_publisher=true; reduces reputation risk but no featured badge.
• host_permissions_all_urls manifest <all_urls> host permission + content_scripts on <all_urls>; justified for Adblock category.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts, no CVEs.
• operator_cluster api sibling_count=0; install_url sibling_count=1 (self). No sibling extensions detected.

Permissions Breakdown

• storage low Stores extension settings locally; minimal risk.
• scripting medium Allows injecting scripts into pages; medium risk without broader host misuse.
• declarativeNetRequest medium Core to popup-blocking function; can block/redirect network requests.
• alarms low Schedules background tasks; low risk in isolation.
• <all_urls> (host_permissions) high Grants access to all sites. Justified for popup blocker but broad surface area.
• <all_urls> (content_scripts) high Content scripts run on every page; broad reach even if purpose is legitimate.

Pillar Scores

Bookkeeping