Top Risks

• Privacy policy is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — no extension-scoped disclosure.
• Broad <all_urls> host access combined with scripting and declarativeNetRequestWithHostAccess enables full page manipulation on every site.
• Free-webmail developer (gmail) with no verified business identity raises accountability concerns.
• Install-URL hijack detected: onInstalled opens internal Options page but pattern is flagged.
• 21 months since last update: extension is approaching stale territory with no maintenance signals.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — scores +10.0 per v3.5 rule D.
• broad_host_access manifest <all_urls> host_permission paired with scripting and declarativeNetRequestWithHostAccess; category MediaDownloader gets justified-broad discount.
• free_webmail_developer store Developer email techiewayz@gmail.com; no business domain, no verified publisher badge.
• install_url_hijack crx install_url_hijack=true targeting /src/Options/index.html (internal path, not 3rd-party).
• maintenance_stale store Last updated September 2024; 21 months since update maps to +6.0 maintenance score band.
• dom_sink_innerhtml_userctrl crx react-dom-17.0.2.min.js: innerHTML assignment from variable; no CSP present elevates to +2.0 per FIX B.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true: 5,000 installs with HIGH-tier permission combination.
• no_csp manifest content_security_policy is null (MV3 so no +2.0 network penalty, but dom_sink risk elevated per FIX B).

Permissions Breakdown

• activeTab low Limited to current tab on user gesture; low standalone risk.
• scripting medium Can inject scripts into pages; elevated with <all_urls> host permission.
• downloads medium Can initiate file downloads to user filesystem.
• declarativeNetRequest medium Can block/redirect network requests via static rules.
• declarativeNetRequestWithHostAccess high Can modify requests on any host; HIGH permission per rubric.
• storage low Local extension storage only.
• <all_urls> high Broad host access across all sites; amplifies scripting and netRequest risks.

Pillar Scores

Bookkeeping