Top Risks

• Broad host permissions (http://*/* + https://*/*) allow reading/injecting content on every site visited.
• Privacy policy is generic Google account policy — not scoped to this extension; admits data collection and third-party sharing.
• Install URL hijack redirects to softoolhub.com on install; uninstall URL also hijacked — monetization/tracking indicators.
• Free-webmail developer (gmail.com) with no verified business identity; developer domain not resolvable.
• No CSP + dom_sink_innerhtml_userctrl in JS; XSS risk on all pages the extension touches.

Evidence

• broad_host_permissions manifest host_permissions include http://*/* and https://*/* granting access to all sites.
• install_url_hijack crx onInstalled opens https://softoolhub.com/spellcheck — 3rd-party URL injection on install.
• uninstall_url_hijack crx setUninstallURL points to https://softoolhub.com/spellcheckuninstall — tracking on uninstall.
• generic_privacy_policy store Privacy policy is Google account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email david834walker@gmail.com with no verified business domain.
• dom_xss_sink crx 130.js: innerHTML assignment from variable with no CSP present — DOM-XSS risk across all visited pages.
• ext_ads_host crx js_external_hosts includes ext-ads-mvp.captain-products.workers.dev — ad-tech endpoint referenced in JS.
• no_csp manifest content_security_policy is null; no script-src restrictions on MV3 extension.

Permissions Breakdown

• sidePanel low UI panel only; no data access by itself.
• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local extension storage; no cross-site data access.
• http://*/* high Broad host access to all HTTP sites; enables content injection and data read.
• https://*/* high Broad host access to all HTTPS sites; paired with HTTP covers entire web.

Pillar Scores

Bookkeeping