Top Risks

• Privacy policy is Google's generic account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case classification, not scoped to this extension.
• Extension last updated 26 months ago; stale MV3 extension with no maintained changelog.
• eBay brand mentioned in name/title by unverified gmail developer — confirmed impersonation flag.
• Free-webmail developer (gmail) with no business domain; no verified publisher badge.
• No CSP declared (MV3 provides some default but absence of explicit policy noted).

Evidence

• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 D).
• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[ebay], developer_domain=gmail.com, confirmed_owner=false → +2.0 Reputation.
• maintenance_stale store months_since_update=26 (24-36mo band) → Maintenance pillar +8.5.
• free_webmail_dev store Developer email mountassirhafi@gmail.com; no business website; free-webmail + no verified publisher → Reputation floor applied.
• featured_by_google store is_featured_by_google=true provides -2.0 Reputation discount, partially offsetting impersonation/gmail signals.
• no_csp manifest content_security_policy=null; MV3 so no +2.0 network penalty, but noted for context.
• clean_code_scan crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[]; no malicious code indicators.
• no_cve_findings crx cve_findings_raw=[]; no vulnerable bundled libraries detected.

Permissions Breakdown

• webNavigation medium Can observe navigation events across all tabs; moderate risk but fits stated filtering function.
• storage low Stores extension settings locally; low risk.

Pillar Scores

Bookkeeping