Top Risks

• Google privacy policy used as extension policy: does not describe this extension's data collection; generic and out-of-scope.
• No developer name, email, or store title available; unverifiable identity with no accountability.
• webRequest + declarativeNetRequestWithHostAccess over TikTok domains enables full request interception and modification.
• install_url_hijack flagged; onInstalled opens external Chrome Web Store URL.
• new Function() constructor detected in app.js; dynamic code execution risk, especially with no CSP.

Evidence

• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• no_developer_identity store developer_name, developer_email, and title are all empty; extension is effectively anonymous.
• high_permissions_webrequest_dnr manifest webRequest + declarativeNetRequestWithHostAccess over *.tiktok.com/* and *.tiktokv.com/*.
• install_url_hijack crx onInstalled opens https://chromewebstore.google.com/detail/ — low-severity but anomalous.
• function_constructor crx new Function() in js/app.js; dynamic code eval risk compounded by absent CSP.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; no trust anchors present.
• months_since_update_unknown api last_updated is null; maintenance pillar scored conservatively at mid-range (unknown).

Permissions Breakdown

• storage low Local data storage only; low standalone risk.
• tabs medium Access to tab URLs and metadata; moderate risk.
• downloads medium Can initiate and manage file downloads.
• declarativeNetRequestWithHostAccess high Can modify/block network requests on declared hosts; HIGH capability.
• webRequest high Observe all network requests on declared hosts; significant intercept capability.
• https://*.tiktokv.com/* high Broad host access to TikTok CDN; enables full request interception.
• https://*.tiktok.com/* high Broad host access to TikTok main domain; combined with webRequest = HIGH.

Pillar Scores

Bookkeeping