Top Risks

• Privacy policy URL timed out — cannot verify any data handling disclosures; treated as no policy.
• Broad host permission (*://*/*) paired with scripting allows script injection on any site.
• Last updated 16 months ago; stale for an extension with broad host access.
• Free-webmail developer (gmail.com), no developer name listed, reducing accountability.
• MV3 with no CSP declared; no external hosts observed but no policy safety net.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL returned ConnectTimeout; classified as fetched=false → +10.0 privacy pillar.
• broad_host_permission manifest host_permissions includes *://*/* giving access to all URLs combined with scripting API.
• free_webmail_dev_no_name store Developer email jjohnslemon@gmail.com; developer_name empty; no verified business identity.
• stale_extension store 16 months since last update; falls in 12-24mo band (+6.0 maintenance).
• verified_publisher_featured store Extension carries verified_publisher=true and is_featured_by_google=true; reputation discount applied.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty; code quality clean.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries bundled.
• no_threat_intel_hits api bad_host_hits, monetization_hits, affiliate_hits all empty; no malicious network signals.

Permissions Breakdown

• storage low Stores local drawing data; low risk for a paint app.
• activeTab medium Access to current tab on user action; limited scope but enables page interaction.
• scripting medium Can inject scripts into pages; paired with host_permissions elevates risk.
• *://*/* high Broad host access covers all URLs; scripting+activeTab+this is a high-capability combo.

Pillar Scores

Bookkeeping