Top Risks

• Privacy policy is Google's generic account policy — does not mention this extension, its data collection, or retention.
• Brand impersonation: YouTube branding used by unverified free-webmail developer with no developer name.
• cookies permission on YouTube domains allows reading session cookies; combined with undisclosed data handling is a risk.
• No developer name provided; sole identity is a gmail address with no associated business entity.
• uninstall_url_hijack flagged true (target null — may fire on uninstall but destination unknown).

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false, not recognized org → +2.0 Reputation.
• free_webmail_no_devname manifest developer_email=gmail.com, developer_name empty, no business website → Reputation floor ≥7.5 applies; floor overrides.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true → -3.0 and -2.0 Reputation, but floor=7.5 due to free-webmail+no-name.
• uninstall_url_hijack crx uninstall_url_hijack=true; target is null so destination unknown — warrants caution.
• cookies_scoped_youtube manifest cookies permission declared; host_permissions scoped to YouTube domains only. Justified-broad discount applies (Entertainment/YouTube tool).
• no_csp manifest content_security_policy=null; MV3 has strict default so no +2.0 network penalty, but dom sinks could be less constrained.
• installs_200k store 200,000 installs → +1.0 Webstore (>100K threshold).

Permissions Breakdown

• cookies high Can read/write cookies on YouTube domains via host_permissions; scoped to YouTube only.
• storage low Local extension storage for user settings.
• host: https://youtube.com/* medium Scoped to YouTube only; matches stated function.
• host: https://*.youtube.com/* medium Includes subdomains like music.youtube.com; matches stated function.
• host: https://www.youtube-nocookie.com/* low Scoped to YouTube nocookie embed domain; narrow.
• host: https://youtube.googleapis.com/* low YouTube API domain; consistent with HD/FPS control function.

Pillar Scores

Bookkeeping