Top Risks

• Broad http://*/* and https://*/* host permissions far exceed the stated Ozon/Wildberries function.
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer is a free-webmail Gmail account with no verifiable business identity.
• External JS host api.24youtest.ru is unknown/unverifiable and not a marketplace domain.
• Small install base (178) combined with HIGH-tier permissions creates tail-attack surface.

Evidence

• broad_host_permissions manifest http://*/* and https://*/* declared alongside specific marketplace domains — over-privileged for stated function.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• free_webmail_developer store Developer email brandhello897@gmail.com; no business website; free webmail raises reputation risk.
• unknown_external_host crx api.24youtest.ru appears in js_external_hosts; not a marketplace domain; unverifiable third-party endpoint.
• install_perm_anomaly api 178 installs with has_high_tier_permission=true; small_install_high_perm=true flagged.
• no_csp manifest content_security_policy is null; MV3 has strict default but absence of explicit CSP noted.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust anchors present.
• scope_mismatch_host manifest content_scripts scoped to 4 marketplace URLs but host_permissions include all URLs — mismatch adds +1.

Permissions Breakdown

• storage low Standard local state storage; low risk.
• downloads medium Can save files to user's disk; matches stated download-images function.
• contextMenus low Adds right-click menu items; minor surface.
• offscreen low Offscreen document for canvas/image processing; low if no exfil.
• scripting medium Programmatic script injection into pages; elevated when paired with broad host access.
• http://*/* high Broad host access over all HTTP sites; beyond stated Ozon/WB scope.
• https://*/* high Broad host access over all HTTPS sites; over-privileged for a marketplace tool.
• https://seller.ozon.ru/* low Scoped to declared primary site; matches function.
• https://seller.wildberries.ru/* low Scoped to declared primary site; matches function.
• https://www.ozon.ru/* low Scoped to declared primary site; matches function.
• https://www.wildberries.ru/* low Scoped to declared primary site; matches function.
• https://*.ozon.ru/* low Ozon subdomain wildcard; consistent with product CDN access.
• https://*.ozone.ru/* low Minor: slightly different domain from ozon.ru; possible typo or CDN.
• https://*.ozonusercontent.com/* low Ozon user content CDN; expected for image scraping.
• https://*.wbbasket.ru/* low Wildberries CDN; expected for image scraping.
• https://*.wb.ru/* low Wildberries domain; expected for image scraping.
• https://*.wbstatic.net/* low Wildberries static CDN; expected for image scraping.
• https://*.geobasket.ru/* low Wildberries geo CDN; expected for image scraping.
• https://*.wbcontent.net/* low Wildberries content CDN; expected for image scraping.

Pillar Scores

Bookkeeping