Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Developer is a free-webmail (gmail) user with no business name, raising accountability concerns.
• No CSP present (MV3 default mitigates somewhat, but inline injection risk remains).
• Low install count with gmail dev and no verified publisher reduces accountability.
• scripting permission allows JS injection into active tab content.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy pillar.
• developer_email_free_webmail store Developer email xanderliteplo@gmail.com; no business name, no dev website; floor reputation >= 7.5.
• no_csp manifest content_security_policy is null; MV3 default policy applies but no explicit hardening.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts; clean scan.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• threat_intel_clean api bad_host_hits, affiliate_hits, monetization_hits all empty; no threat signals.
• maintenance_recent store Last updated January 21, 2026; 5 months ago — active maintenance band (+1.5).
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust discount available.

Permissions Breakdown

• activeTab low Grants access to current tab only on user action; narrow scope.
• scripting medium Can inject scripts into pages; paired with activeTab limits scope but still notable.
• contextMenus low Adds right-click menu items; minimal risk.
• storage low Local/sync storage for user preferences; no data exfil path alone.

Pillar Scores

Bookkeeping