Top Risks

• Brand impersonation: title uses Google™ trademark but developer is unverified gmail user with no dev name.
• Privacy policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 per v3.5 rule D.
• Install/uninstall URL hijack flags set; uninstall redirects to third-party URL (target unknown).
• Description promises recording but lacks tabCapture/desktopCapture permissions — description mismatch detected.
• Free-webmail dev (gmail) with no developer name; privacy policy domain (freebusinessapps.net) differs from dev email domain.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; title uses Google™ trademark; developer email is gmail, confirmed_owner=false.
• privacy_policy_generic_with_data_sharing api Fetched policy: scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D +10.0.
• install_uninstall_url_hijack crx install_url_hijack=true AND uninstall_url_hijack=true; targets not captured but pattern is monetization/redirect.
• description_permission_mismatch store Promises recording but lacks tabCapture/desktopCapture; may be non-functional shell or misrepresented.
• free_webmail_dev_no_name store developer_email=alexeystore4@gmail.com; developer_name empty; no verified business identity.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; partially offsets reputation risk.
• no_csp manifest csp_present=false on MV3 extension; MV3 has strict default so no network penalty applied.
• js_external_hosts crx js_external_hosts=[chrome.google.com, microsoftedge.microsoft.com]; both are known browser-vendor domains, low risk.

Permissions Breakdown

• storage low Local key-value storage; standard for saving settings.
• offscreen low Allows off-screen document creation; low standalone risk but used for capture pipelines.
• unlimitedStorage low Unlimited local storage; reasonable for a recorder storing video files.

Pillar Scores

Scoring History

Bookkeeping