Top Risks

• TikTok brand impersonation by unverified gmail developer with numbered alias email (richardmontford6152@gmail.com).
• Install-URL hijack redirects to https://www.tiktok.com/@tiktok — install event exploited for traffic/redirect.
• Privacy policy admits data collection AND third-party sharing but not scoped to this extension; retention not disclosed.
• Low rating (2.7) and 24-month stale extension with no CSP increases residual exploitation window.
• webRequest on TikTok domain by unknown solo developer enables request inspection of authenticated sessions.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false; TikTok brand used by gmail dev with no verified affiliation.
• install_url_hijack manifest install_url_hijack=true targeting https://www.tiktok.com/@tiktok; onInstalled opens 3rd-party URL.
• free_webmail_developer store Developer email richardmontford6152@gmail.com — numbered alias gmail, no business domain.
• privacy_policy_data_collection_third_party api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_csp manifest content_security_policy=null on MV3 extension; no explicit CSP hardening declared.
• stale_extension store months_since_update=24; last updated June 2024, no changelog evidence.
• low_rating store Rating 2.7; no review red flags matched but overall low user satisfaction signal.
• webrequest_high_perm manifest webRequest declared with host_permissions *://*.tiktok.com/* — can inspect authenticated TikTok traffic.

Permissions Breakdown

• webRequest high Can intercept and inspect all network requests to tiktok.com; powerful surveillance capability.
• storage low Local extension storage only; low inherent risk.
• *://*.tiktok.com/* (host) medium Scoped to single domain; matches stated function but enables full page access on TikTok.

Pillar Scores

Bookkeeping