Top Risks

• <all_urls> host permission allows broad content access
• Install hijack opens chrome://settings (unusual behavior)
• InnerHTML DOM sink present but CSP mitigates

Evidence

• broad_host_access manifest <all_urls> in host_permissions enables content script injection on all sites
• install_hijack manifest Install URL hijack opens chrome://settings/system (non-standard)
• dom_sink crx innerHTML assignment from variable in mootools-core.js (CSP present)
• verified_publisher store Verified publisher badge present
• privacy_policy api Scoped policy with collection, retention, and 3rd-party disclosure
• no_cves crx No CVE findings in bundled libraries
• recent_update store Updated within 3 months (actively maintained)

Permissions Breakdown

• system.display low Display info access, minimal risk
• scripting medium Can inject scripts into pages
• activeTab low Temporary access to active tab only
• notifications low Show notifications, minimal risk
• contextMenus low Add context menu items
• unlimitedStorage low Extended local storage
• storage low Local data storage
• <all_urls> high Broad host access across all sites

Pillar Scores

Bookkeeping