Top Risks

• Privacy policy is Google's generic account policy (scope_extension=false, admits data_collection+third_party_sharing) — worst-case privacy score.
• Developer email is free webmail (gmail.com) with no verified business identity.
• new Function() constructor found in background script; appears to be a webpack boilerplate pattern but warrants review.
• No CSP declared (MV3 mitigates somewhat but adds surface for future issues).
• installs > 10K with unverified developer raises blast-radius concern if extension is ever transferred.

Evidence

• privacy_policy_generic store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store tabwrangler@gmail.com — no verified business domain; reputation floor applies.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount.
• function_constructor crx new Function('return this') in background.entry.js; likely webpack __webpack_require__ boilerplate.
• no_csp manifest content_security_policy is null; MV3 enforces strict defaults so no Network penalty, but no explicit hardening.
• no_bad_hosts api threat_intel.bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — clean.
• cve_findings_empty crx No CVEs detected in bundled libraries.
• install_count_60k store 60,000 installs; +1.0 webstore reach signal.

Permissions Breakdown

• alarms low Schedules periodic tab-closing tasks; no data access.
• contextMenus low Adds right-click menu items; low risk.
• sessions medium Can read recently closed tabs/windows; moderate sensitivity.
• storage low Stores local settings; no remote sync implied.
• tabGroups low Manages tab groups; no content access.
• tabs medium Reads tab URLs and titles; moderate privacy surface.
• favicon low Reads favicon URLs for display; low risk.

Pillar Scores

Bookkeeping