Top Risks

• Brand impersonation: mentions 'ChatGPT' with confirmed_owner=false and is_impersonation=true; not verified publisher.
• Install-URL hijack on install redirects user to chatgpt.com with tracking param; uninstall hijack redirects to dev offboarding page.
• Content script runs inside ChatGPT sessions — can read all user prompts and AI responses at 400K installs.
• No CSP + innerHTML DOM-XSS sink in bundled React JSX runtime increases XSS risk.
• Geo-diverse JS hosts (DE, HK, IE, US, 4 countries) with 6 external hosts including talkio.ai and voicecontrol.pro.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands=['chatgpt'], confirmed_owner=false, not verified_publisher.
• install_url_hijack crx onInstalled opens https://chatgpt.com/?new-vc-install=true; uninstall opens voicecontrol.chat/feedback/offboarding.
• content_script_sensitive_page manifest Content scripts injected into chat.openai.com/* and chatgpt.com/* — all user/AI conversation text in scope.
• no_csp_plus_dom_sink crx csp_present=false AND dom_sink_innerhtml_userctrl in jsx-runtime; FIX B applies (+2.0 code quality).
• geo_diversity crx JS external hosts span 4 countries (DE, HK, IE, US); includes talkio.ai and voicecontrol.pro beyond primary domain.
• monetization_telemetry api google-analytics.com in js_external_hosts; only telemetry-tier hit, +1.0 webstore.
• featured_by_google store is_featured_by_google=true; reduces reputation risk but does not negate impersonation signal.
• privacy_policy_no_retention api Policy fetched, scoped, data_collection=false but retention=false and third_party_silence=true.

Permissions Breakdown

• storage low Stores extension settings locally; no cross-origin data exfil risk on its own.
• content_scripts: https://chat.openai.com/*, https://chatgpt.com/* medium Injects JS into ChatGPT sessions; can read user prompts and AI responses.

Pillar Scores

Bookkeeping