Top Risks

• webRequest + broad host access (<all_urls>) enables full request observation across every site visited.
• scripting + broad host access allows arbitrary JS injection on all HTTP/HTTPS pages.
• No CSP on MV3 extension with 8 external JS hosts including tinyurl.com and github.com.
• innerHTML DOM-XSS sink in hermesSDK.js without CSP guard — exploitable if data is attacker-influenced.
• Privacy policy discloses third-party data sharing; shopping extension contacts 8 distinct external domains.

Evidence

• broad_host_permissions manifest host_permissions: http://*/* and https://*/* grant access to every site.
• webRequest_broad manifest webRequest declared with all-URL host permissions — full request observation capability.
• no_csp crx content_security_policy is null; no script-src restriction on MV3 extension.
• external_hosts crx 8 distinct external JS hosts including tinyurl.com, github.com, fe-evas.fih.io, vio.com.
• dom_xss_sink crx innerHTML assignment in js/hermesSDK.js — DOM-XSS risk, amplified by absent CSP.
• verified_publisher_featured store Extension is verified publisher and featured by Google; reputation floored at 2.0.
• privacy_policy_third_party api Policy fetched, scoped, retention disclosed, but third_party_sharing == true adds +1.0 privacy.
• geo_diversity crx JS hosts span 3 countries (CA, IN, US); below threshold of 4 for geo-diversity penalty.

Permissions Breakdown

• tabs medium Can read tab URLs and titles; paired with broad host access increases sensitivity.
• scripting high Programmatic script injection into pages; broad host access makes this near-universal.
• webRequest high Observe all browser requests across all sites; core tracking/monitoring capability.
• storage low Local data persistence only; low standalone risk.
• http://*/* high Broad host access over HTTP for all sites.
• https://*/* high Broad host access over HTTPS for all sites.

Pillar Scores

Scoring History

Bookkeeping