Top Risks

• Privacy policy not scoped to this extension; admits data collection and third-party sharing without extension-specific context.
• Content scripts injected on virtually every Google TLD plus Bing, Yahoo, DuckDuckGo — broad search-engine reach.
• Developer name field is empty, reducing accountability despite verified publisher badge.
• install_url_hijack flag is true — onInstalled opens a third-party URL.
• Rating of 3.1 may indicate user dissatisfaction, though rating_count unknown.

Evidence

• verified_publisher + featured store Extension carries both verified publisher and Google featured badges; reputation floor applied at 2.0.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar = 10.0 per v3.5 rule D.
• install_url_hijack crx install_url_hijack=true; onInstalled opens external URL. +2.0 Webstore signal applied.
• broad_content_script_reach manifest Content scripts match 190+ Google TLDs plus Bing, Yahoo, DuckDuckGo, AOL — all global search engines.
• no_code_findings crx 0 JS findings, obfuscation_score=0.0, no CVEs, all external hosts are britannica.com subdomains.
• csp_strict manifest CSP: script-src 'self'; object-src 'self' — no remote script sources allowed.
• developer_name_missing store developer_name is empty string; reduces accountability despite verified publisher status.
• no_bad_hosts_no_monetization api threat_intel shows no bad_host_hits, no monetization_hits, no affiliate_hits; domain eb.com resolves.

Permissions Breakdown

• contextMenus low Adds right-click menu items; minimal risk.
• host: https://school.eb.com/* medium Scoped to Britannica's own domain; aligns with stated function.
• host: https://indie-api.britannica.com/* medium Britannica API endpoint; developer-controlled.
• host: https://indie-api.dev.britannica.com/* low Dev/staging Britannica API; developer-controlled.
• content_scripts: google.*/search, bing, yahoo, duckduckgo, aol medium Scripts run on all major search engines globally; broad reach but purpose is search-result annotation.

Pillar Scores

Bookkeeping