Top Risks

• Severely stale: 107 months without update — MV2 extension frozen since 2017, high future compromise risk.
• Generic Google account privacy policy not scoped to this extension; admits data collection and third-party sharing.
• MV2 + no CSP: no default script injection protection, +2.0 network risk.
• Install count unavailable — blast radius and user exposure unknown.
• Developer name absent from listing despite verified publisher badge.

Evidence

• verified_publisher store Google verified publisher; developer email docs-extension-support@google.com on google.com domain (resolves, not throwaway).
• extreme_staleness store Last updated October 2017 — 107 months ago. >36mo maintenance score = 10.0 + zombie booster not applicable (installs unknown).
• mv2_no_csp manifest MV2 extension with csp_present=false triggers +2.0 network penalty per v2 calibration fix (b).
• generic_privacy_policy api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → generic policy admitting sharing: +10.0 privacy per v3.5 rule D.
• no_permissions manifest Empty permissions[], host_permissions[], content_scripts_matches[]. No active capability declared.
• js_external_host crx One external JS host: docs.google.com — Google-owned, low threat but counted for network surface.
• no_cve_findings crx cve_findings_raw is empty; no bundled vulnerable libraries detected.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; code quality pillar = 0.0.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• aapocclcgogkmnckokdopfmhonfmgoek

Scoring History

Bookkeeping