Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing (v3.5 D: +10.0).
• Brand impersonation: extension names TikTok and Instagram without verified ownership, triggering +2.0 reputation penalty.
• Extension is 25 months stale (no update since May 2024), raising supply-chain and abandonment risk.
• 7 external JS hosts contacted (imginn.com, picuki.com, urlebird.com, xaller.com, etc.) — unrecognized third-party redirectors with no CSP.
• No CSP present on MV3 extension that contacts 7 external domains including unrecognized redirect aggregators.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for TikTok/Instagram; developer not confirmed owner → +2.0 reputation.
• stale_extension store Last updated May 2024, 25 months ago → maintenance +6.0 (12-24mo band).
• external_hosts crx 7 external JS hosts: imginn.com, picuki.com, urlebird.com, xaller.com, plus instagram/tiktok domains. No CSP.
• no_csp manifest content_security_policy is null; MV3 has strict default but 7 external hosts increases exposure without explicit CSP.
• featured_by_google store is_featured_by_google=true; provides -2.0 reputation discount.
• no_bad_hosts api threat_intel bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no confirmed malicious infra.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0, cve_findings_raw=[] — clean static analysis.

Permissions Breakdown

• storage low Used to persist redirect preferences locally; low standalone risk.
• tabs medium Can read tab URLs; needed for redirect logic but allows URL surveillance.

Pillar Scores

Bookkeeping