Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Email checker - verify email address in 1-click + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — unscoped, admits data collection & 3rd-party sharing; scores maximum 10.
• Install URL hijack: onInstalled opens https://email-checker.pro/welcome (+2.0 Webstore).
• Uninstall URL hijack declared (+3.0 Webstore).
• Extension is 22 months stale (>18mo), triggering maintenance penalty and capping verified-publisher discount.

Evidence

• install_url_hijack crx onInstalled opens https://email-checker.pro/welcome — unsolicited tab open on install.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() declared; target not resolved but flag is true.
• generic_privacy_policy store Policy URL is Google's own privacy page (myaccount.google.com), not scoped to this extension; data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; no 'Offered by' identity visible.
• verified_publisher_capped store verified_publisher=true but months_since_update=22 (>18mo) caps discount to -1.0 per invariant 0c/3.5E.
• stale_extension store 22 months since last update; maintenance score 6.0 (12-24mo band).
• external_js_host crx js_external_hosts: ['email-checker.pro'] — extension contacts developer domain at runtime.
• csp_absent_mv3 manifest content_security_policy is null; MV3 has strict defaults so no Network penalty applied, but no explicit CSP.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Email checker - verify email address in 1-click + malext.io malicious_extension_sentry; score 4.79 -> 7.29 (+2.5 cap 2.5).

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local key-value storage only; no exfil risk alone.

Pillar Scores

Bookkeeping