Top Risks

• Instagram brand impersonation by free-webmail gmail developer with no verified identity.
• cookies + webRequest on Instagram enables session token harvesting.
• Privacy policy is generic Google account policy — does not scope to this extension at all.
• new Function() constructor in app.js allows dynamic code execution from string input.
• Contacts non-Instagram external hosts (periodic.metricuser.com, user.extension-info.com) with no CSP.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'instagram'; developer is gmail individual, not Meta.
• generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• suspicious_external_hosts crx js_external_hosts includes periodic.metricuser.com and user.extension-info.com alongside instagram.com.
• function_constructor crx new Function() in js/app.js allows dynamic eval of string-based code.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on eval/remote.
• high_risk_permission_combo manifest webRequest + cookies + host_permissions on *.instagram.com enables full session interception.
• free_webmail_developer store Developer email chasewitherspoon08@gmail.com; no business domain; unverifiable identity.
• featured_by_google store is_featured_by_google=true; provides partial trust signal but does not override impersonation risk.

Permissions Breakdown

• webRequest high Can observe/intercept all network requests to Instagram, including auth tokens.
• cookies high Access to Instagram session cookies; combined with webRequest elevates risk.
• storage low Local extension data storage; low standalone risk.
• downloads medium Can write files to disk; expected for downloader but adds capability surface.
• tabs medium Can read tab URLs/titles across browser; broader than strictly needed.
• https://*.instagram.com/* high Broad host access to all Instagram pages; enables content script injection and cookie access.

Pillar Scores

Bookkeeping