Top Risks

• No CSP + broad host permissions (https://*/*) + content scripts on every page — high exfil surface if code ever compromised.
• Privacy policy hosted on unrelated domain (startpage24.com, 230 chars) with scope_extension=false; effectively non-scoped.
• No developer name listed; developer identity unverified despite 5M installs.
• 12 external JS hosts contacted including non-canonical domains (videodownloaderultimate.com); >3 distinct registrable domains.
• MV3 with no CSP; v2 calibration +2.0 Network applies for MV2 only, but absence of CSP still leaves no script isolation.

Evidence

• broad_host_plus_webrequest manifest webRequest + https://*/* + content_scripts on all URLs; justified for VideoDownloader but maximum capability surface.
• no_csp manifest content_security_policy is null; no script-src restrictions in place.
• privacy_policy_inadequate crx Policy hosted on startpage24.com (230 chars); fetched=true but scope_extension=false, data_collection=false → +9.0 privacy.
• no_developer_name store developer_name is empty string; +1.0 reputation penalty applied.
• external_hosts_count crx 12 js_external_hosts across >3 registrable domains including videodownloaderultimate.com and multiple video platforms.
• featured_by_google store is_featured_by_google=true; -2.0 reputation discount applied (Follows recommended practices).
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, no CVEs; code quality pillar = 0.
• recently_updated store months_since_update=3; maintenance pillar = 0.0.

Permissions Breakdown

• webRequest high Can observe/intercept all HTTPS network requests; core to video URL detection but high-risk.
• https://*/* high Broad host access across all HTTPS sites; paired with webRequest elevates risk.
• content_scripts_matches: http://*/*, https://*/* high Content scripts injected into every page; can read/modify any page content.
• tabs medium Access to tab URLs and metadata; needed for video detection.
• downloads medium Can trigger file downloads; matches stated VideoDownloader function.
• sidePanel low Displays side panel UI; low independent risk.
• storage low Local extension storage; no cross-site concern.

Pillar Scores

Bookkeeping