Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Gofullpage Full Page Scre (+2.0, capped).
• Privacy policy fetched but scope_extension=false and data_collection=false — policy does not address this extension specifically.
• No CSP defined (MV3 default strict but no explicit CSP); 3 innerHTML DOM-XSS sinks present in page-injected and welcome scripts.
• install_url_hijack=true — onInstalled opens an external URL; target is null so destination unknown.
• No developer name listed; only email on dev-owned domain gofullpage.com.

Evidence

• install_url_hijack crx install_url_hijack=true, target=null; onInstalled redirects to unknown external URL.
• privacy_policy_scope api Policy fetched (56 chars) but scope_extension=false, data_collection=false — too short to be meaningful.
• dom_xss_sinks crx 3 innerHTML assignments from variables in page-injected script and welcome bundle; no CSP to mitigate.
• description_mismatch store Description promises 'recording' but lacks tabCapture/desktopCapture permissions.
• no_developer_name store developer_name is empty; identity relies solely on support@gofullpage.com email.
• featured_by_google store is_featured_by_google=true; follows recommended practices badge applies.
• no_cve_findings crx cve_findings_raw is empty; React 16.13.1/17.0.2 bundled but no flagged CVEs.
• maintenance_unknown store last_updated and months_since_update are null; staleness cannot be assessed.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Gofullpage Full Page Scre; score 3.28 -> 5.28 (+2.0 cap 2.5).

Permissions Breakdown

• activeTab medium Access to current tab on user action — limited scope but enables page content read.
• scripting medium Can inject scripts into pages; paired with activeTab keeps scope narrow.
• storage low Stores extension settings locally.
• unlimitedStorage low Needed to store full-page screenshots; no extra data-access capability.

Pillar Scores

Bookkeeping