Top Risks

• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — does not cover this extension.
• Developer uses free Gmail address with no verified business identity.
• uninstall_url_hijack=true flag raised; target is null but signal is present.
• Content script injected into extensionpay.com payment pages; potential payment-flow visibility.
• 26 installs, zero ratings — no community vetting; very new or niche deployment.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → privacy pillar = 10.0.
• free_webmail_developer store Developer email yorch65cults@gmail.com; no business domain; no verified publisher badge.
• uninstall_url_hijack crx uninstall_url_hijack=true with null target; flag present in manifest scan.
• content_script_payment_domain manifest content_scripts_matches includes https://extensionpay.com/* — scripts run on payment provider pages.
• js_external_hosts crx References to developer.mozilla.org, extensionpay.com, github.com, stackoverflow.com — all documentation/OSS; low threat.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — clean code surface.
• low_install_count store Only 26 installs; no ratings; install_perm_anomaly.small_install_high_perm=false.
• csp_present_mv3 manifest script-src 'self'; object-src 'self' — strict CSP, MV3; no remote code loading.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• activeTab low Access to current tab only on user gesture; scoped and transient.
• scripting medium Allows JS injection into pages; paired with activeTab limits blast radius.
• content_scripts on extensionpay.com medium Content script on payment provider; monitors payment page interactions.

Pillar Scores

Bookkeeping