Top Risks

• new Function() constructor in 3 files (options, main, background) — dynamic code execution risk without CSP guard.
• innerHTML DOM-XSS sinks in 3 files including content_script running on all sites — attacker-controlled page content could execute.
• No content_security_policy: dom_sink_innerhtml_userctrl findings escalate to +2.0 under v3 FIX B.
• declarativeNetRequestWithHostAccess + broad host_permissions enables network request modification on every visited site.
• No developer name listed; verified publisher badge partially mitigates but identity gap remains.

Evidence

• code_quality_function_constructor crx new Function() in options.js, main.js, background_script.js — dynamic code execution path present.
• code_quality_dom_xss_no_csp crx innerHTML sinks in options.js, main.js, content_script.js with no CSP — FIX B escalation applied.
• no_content_security_policy manifest content_security_policy is null; MV3 has strict defaults but dom-sink risk is elevated without explicit CSP.
• broad_host_permissions manifest http://*/* and https://*/* with content_scripts on same scope — full DOM access on every site.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; reputation floor applied at 2.0.
• privacy_policy_third_party_sharing api Policy is scoped and discloses data collection with retention but admits third-party sharing; +1.0 privacy.
• no_bad_hosts_no_cves api cve_findings_raw empty, bad_host_hits empty, monetization_hits empty — no threat-intel hits.
• recently_updated store months_since_update=1; maintenance pillar=0.0.

Permissions Breakdown

• storage low Saves user preferences locally; limited risk.
• downloads medium Initiates file downloads; core to stated function but can be abused.
• tabs medium Reads tab URLs/titles; needed for image detection across pages.
• offscreen low Creates offscreen documents; low direct risk but expands execution surface.
• declarativeNetRequest medium Can block/redirect network requests; needed for bypass of hotlink protection.
• declarativeNetRequestWithHostAccess high Modifies network requests on all hosts; high-impact combined with broad host access.
• http://*/* high Broad host access to all HTTP sites; content scripts injected everywhere.
• https://*/* high Broad host access to all HTTPS sites; full DOM read/write on every page.

Pillar Scores

Bookkeeping