Top Risks

• Privacy policy fetched but does NOT scope to this extension, admits data collection AND third-party sharing → Privacy pillar 10.0.
• tabCapture permission can record audio/video of any browser tab; content_scripts on *://*/* maximises reach.
• cookies permission combined with broad content script reach creates session-theft surface.
• Third-party host extension.doreso.com in host_permissions is not the developer's own domain.
• sandbox.js uses new Function() constructor; sandbox CSP allows unsafe-eval, weakening isolation.

Evidence

• privacy_policy_scope_mismatch api Policy fetched (98 KB), scope_extension=false, data_collection=true, third_party_sharing=true → score +10.0.
• tabCapture+content_scripts_all_urls manifest tabCapture can record tab audio/video; content_scripts injected on *://*/* amplifies reach.
• cookies_permission manifest cookies declared alongside broad content-script reach; session exfil risk.
• third_party_host_doreso manifest host_permissions includes https://extension.doreso.com/* — unverified third-party analytics/service.
• function_constructor_sandbox crx new Function() in sandbox.js; sandbox CSP permits unsafe-eval — weakens sandboxing.
• verified_publisher_featured store Extension is verified publisher AND featured by Google; reputation floor 2.0 applied.
• csp_host_cluster_20 api csp_host_set sibling_count=20: same CSP host fingerprint shared with 20 other extensions.
• no_developer_name store developer_name field is empty; verified publisher badge partially offsets but display name missing.

Permissions Breakdown

• identity low OAuth identity flow; limited scope without identity.email alone is moderate but paired here.
• identity.email medium Accesses the user's Google account email address; PII exposure risk.
• storage low Standard local data persistence.
• unlimitedStorage low Allows unbounded local storage; low direct risk but can cache sensitive data.
• activeTab low Scoped to user-activated tab; limited blast radius.
• tabCapture high Can capture audio/video of any browser tab; core to song-detection but high-capability.
• cookies high Broad cookie read/write access; paired with host_permissions on aha-music.com and doreso.com.
• https://*.aha-music.com/* low Scoped to own first-party domain.
• https://extension.doreso.com/* medium Third-party domain not clearly owned by developer; fingerprinting/analytics risk.
• content_scripts: *://*/* high Content script injected on every page; broad reach for audio detection but wide attack surface.

Pillar Scores

Bookkeeping