Top Risks

• Gmail dev (airtronics307@gmail.com) with no verified business; free-webmail floor applies.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection + 3rd-party sharing.
• install_url_hijack: onInstalled opens a third-party URL without a recorded target, indicating unsolicited redirect.
• scripting + <all_urls> + content_scripts on all URLs gives full DOM read/write on every visited site.
• No CSP + dom_sink_innerhtml_userctrl + function_constructor raises XSS/code-injection risk.

Evidence

• free_webmail_developer store Developer email airtronics307@gmail.com — free webmail, no verified business identity.
• generic_google_privacy_policy store Privacy URL is Google's own account policy, scope_extension=false, admits data_collection+3rd-party sharing.
• install_url_hijack crx install_url_hijack=true; onInstalled fires to third-party URL (target null but flag set).
• broad_host_access manifest <all_urls> in host_permissions + content_scripts_matches; scripting permission enables full-page injection.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• external_js_hosts crx 3 external JS hosts: aisidebar.featurebase.app, pay.your-domain.com, platform.sidebarai.app — includes payment endpoint.
• function_constructor crx new Function() in assets/pdf-ksa_hnld.js — dynamic code execution capability.
• dom_sink_innerhtml_userctrl crx innerHTML assignment in assets/App-X9RNdRIT.js with no CSP; DOM-XSS sink.

Permissions Breakdown

• sidePanel low UI panel; low intrinsic risk.
• storage low Local data persistence; low risk.
• unlimitedStorage low Expands storage quota; low risk alone.
• activeTab low Scoped to user-initiated tab; low risk alone.
• scripting medium Programmatic script injection; elevated when paired with <all_urls>.
• tabs medium Access to tab URLs and metadata; medium risk.
• contextMenus low UI surface only; low risk.
• offscreen low Offscreen document; low risk alone.
• <all_urls> (host_permissions) high Grants scripting+content_script access to every site the user visits.

Pillar Scores

Bookkeeping