Top Risks

• Privacy policy fetched but scope_extension=false AND data_collection=true AND third_party_sharing=true — admits broad data sharing without scoping to this extension.
• new Function() constructor in sweetalert.js enables arbitrary code execution from attribute values.
• innerHTML sink on user-controlled data (popup.js) with no CSP — DOM-XSS risk elevated.
• Content script declared on <all_urls> with no CSP gives broad reach across all sites.
• 8 external JS hosts including multiple railway.app slave backends — high exfil surface for a low-install invoice tool.

Evidence

• content_scripts_matches:<all_urls> manifest Content script runs on all URLs despite only activeTab declared in permissions[].
• function_constructor crx new Function() in sweetalert.js constructs code from DOM attribute values — arbitrary execution risk.
• dom_sink_innerhtml_userctrl + no CSP crx innerHTML set from variable in popup.js; csp_present=false amplifies DOM-XSS to +2.0.
• privacy_policy scope mismatch store Policy fetched from github.io/game-development — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• 8 external JS hosts crx Hosts: check-invoice.vercel.app, multiple railway.app slaves, sheetjs.com, sweetalert2.github.io — >3 distinct domains.
• free-webmail developer store Dev email nguyenvantuan2391996@gmail.com — numeric-alias pattern, no verified business domain.
• no CSP + MV3 manifest content_security_policy=null; MV3 has strict default so no +2.0 MV2 penalty applies.
• no bad_host/affiliate/monetization hits api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits.

Permissions Breakdown

• activeTab low Limited to user-initiated interaction on the active tab only.
• content_scripts:<all_urls> high Content script injected on every URL — broad host access despite narrow declared permissions.

Pillar Scores

Bookkeeping