Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing (privacy score max).
• Developer uses free-webmail (outlook.com) with no verified business domain.
• install_url_hijack flag true; onInstalled opens a URL (target null but flag set).
• Extension updated 14 months ago; moderate staleness risk.
• No CSP declared (MV3 mitigates, but js_external_hosts include goo.gl/third-party CDNs).

Evidence

• privacy_policy_generic store Privacy URL is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• free_webmail_developer store Developer email corbindavenport@outlook.com is free webmail; no verified business domain; +1.5 Reputation.
• install_url_hijack crx install_url_hijack=true with null target; onInstalled fires to unknown URL → +2.0 Webstore.
• no_bad_hosts_or_cves crx bad_host_hits=[], cve_findings_raw=[], code_findings_raw=[], obfuscation_score=0.0 — no active threat signals.
• staleness_14mo store Last updated April 2025, months_since_update=14; falls in 12-24mo band → +6.0 Maintenance.
• js_external_hosts crx Extension references getbootstrap.com, github.com, goo.gl, www.charistheo.io — 4 hosts, 2 countries; no bad-host hits.
• narrow_permissions manifest Only activeTab + scripting declared; no host_permissions, no HIGH-tier permissions.
• no_operator_siblings api operator_cluster sibling_count=0; no cluster risk.

Permissions Breakdown

• activeTab low Grants access only to the currently active tab on user interaction; narrow scope.
• scripting medium Allows injecting scripts into pages; combined with activeTab kept narrow.

Pillar Scores

Scoring History

Bookkeeping