Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; collects/shares data per that policy.
• Extension is 27 months stale (last updated March 2024); React 16.8.6 bundled — no CVEs flagged but aging dependency.
• Free-webmail developer (gmail.com) with no verified business identity raises accountability gap.
• Content script runs on <all_urls> giving broad DOM read access across all sites.
• No CSP declared (MV3 default applies, but no explicit policy listed).

Evidence

• generic_privacy_policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 Privacy.
• free_webmail_developer store Developer email pd4d10@gmail.com; no business domain; no verified publisher badge.
• maintenance_stale store 27 months since update (March 2024); falls in 24-36mo band → +8.5 Maintenance.
• content_scripts_all_urls manifest content_scripts_matches=[<all_urls>] with only storage permission declared; DeveloperTools category provides partial justification.
• no_cve_findings crx cve_findings_raw empty; React 16.8.6 bundled but no CVEs triggered.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; no external JS hosts.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; operator sibling_count=0.
• wayback_fetch_error api Wayback ownership check returned fetch_error:ConnectionError; ownership_changed=false by default.

Permissions Breakdown

• storage low Stores extension settings locally; no data exfil risk on its own.
• content_scripts:<all_urls> medium Runs content script on every URL; needed for JSON rendering but broad reach.

Pillar Scores

Bookkeeping