Top Risks

• <all_urls> host permission + scripting allows injection into every site visited.
• Privacy policy fetched but scope_extension=false and length=13 chars — effectively empty/generic.
• new Function() constructor present in all 5 JS files — dynamic code execution risk.
• 19 months since last update; stale maintenance raises abandonment/supply-chain concern.
• Developer email is free webmail (gmail) with no developer name listed.

Evidence

• host_permissions_all_urls manifest <all_urls> host permission paired with scripting — can read/modify every page.
• privacy_policy_stub crx Policy fetched but length=13 chars, scope_extension=false, data_collection=false — not a real policy.
• function_constructor_all_files crx new Function() found in all 5 JS files; common in bundled libs but elevates dynamic-exec risk.
• stale_extension store Last updated January 2025; 19 months since update — above 18mo stale threshold.
• free_webmail_dev_no_name store Developer email advproduction71@gmail.com; no developer name listed on store page.
• verified_publisher_featured store Extension carries both verified_publisher and is_featured_by_google badges.
• no_csp manifest content_security_policy is null; MV3 strict-default applies but no explicit CSP declared.
• no_bad_hosts_no_monetization api threat_intel shows empty bad_host_hits, monetization_hits, and affiliate_hits.

Permissions Breakdown

• storage low Stores extension settings locally; expected for night-shift mode.
• scripting medium Can inject scripts into pages; combined with <all_urls> is elevated.
• tabs medium Access to tab URLs and metadata across all open tabs.
• <all_urls> (host_permission) high Full host access to every site; enables content injection everywhere.

Pillar Scores

Bookkeeping