Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension at all; admits data collection and 3rd-party sharing.
• Install URL hijack: onInstalled opens paypal.me/neophoriac (3rd-party payment page).
• content_scripts match <all_urls> — extension runs on every page despite no host_permissions declared.
• No CSP + two innerHTML-from-variable DOM-XSS sinks across content scripts.
• Free-webmail developer (gmail) with no verified business identity and no domain.

Evidence

• install_url_hijack crx onInstalled opens https://paypal.me/neophoriac — 3rd-party monetization URL on every install.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• content_scripts_all_urls manifest content_scripts matches <all_urls> giving DOM access on every site the user visits.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP hardening.
• dom_xss_sinks crx Two innerHTML-from-variable sinks in quickfind.js and toolkit.js; no CSP mitigates.
• free_webmail_developer store Developer email highlightermagictool@gmail.com; no business domain, no verified publisher badge.
• featured_by_google store is_featured_by_google=true; modest trust signal, partial reputation offset.
• maintenance_stale store Last updated May 2025; 13 months since update maps to 6-month score band (+3.5).

Permissions Breakdown

• tabs medium Can read tab URLs and titles; moderate info exposure.
• storage low Stores highlight preferences locally; low direct risk.
• contextMenus low Adds right-click menu items; low risk.
• content_scripts <all_urls> high Scripts run on every page; broad DOM access across all sites.

Pillar Scores

Bookkeeping