Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• declarativeNetRequestWithHostAccess grants network-level request interception without host_permissions declared explicitly.
• Developer uses free Gmail address with no verified business domain; no verified-publisher badge.
• install_url_hijack and uninstall_url_hijack flags set (targets null but hooks present).
• innerHTML DOM-XSS sink in bundled Readability.js with no CSP; elevated risk if content is attacker-controlled.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; scope_extension=false, data_collection=true, third_party_sharing=true.
• declarativeNetRequestWithHostAccess manifest HIGH-tier permission allowing network request blocking/redirection with host access; no explicit host_permissions listed.
• free_webmail_developer store Developer email yokris.dev@gmail.com is free webmail; no verified publisher badge; no business domain resolved.
• install_uninstall_url_hijack crx install_url_hijack=true and uninstall_url_hijack=true; targets are null but hooks are present.
• dom_sink_innerhtml_no_csp crx Readability.js uses innerHTML with variable content; no CSP present (MV3 default applies but no explicit policy).
• is_featured_by_google store Extension carries Google Featured badge — partial trust signal, reduces but does not eliminate risk.
• operator_cluster_dev_email_siblings api sibling_count=0 by compound fingerprint; dev_email dimension shows 3 siblings — low concern.
• no_csp_mv3 manifest content_security_policy is null; MV3 default restricts remote scripts but no explicit CSP hardens DOM-sink risk.

Permissions Breakdown

• storage low Stores user preferences locally; low risk.
• activeTab medium Access current tab on user action; limited scope but enables DOM read.
• scripting medium Injects scripts into pages; combined with activeTab enables content manipulation.
• contextMenus low Adds right-click menu items; UI-only, minimal risk.
• notifications low Shows desktop notifications; low data-access risk.
• declarativeNetRequestWithHostAccess high Can block/redirect network requests with host access; significant network-layer capability.

Pillar Scores

Bookkeeping