Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, yet admits data collection and third-party sharing (+10 privacy).
• Uninstall URL hijack redirects to banana.summarizer.one/uninstall, a monetization/retention tactic (+3 webstore).
• Install URL hijack detected — onInstalled opens third-party URL (+2 webstore).
• Developer email is Proton (free webmail), no developer name, no verified business identity — elevated reputation risk.
• js_external_hosts includes pay.your-domain.com and react.dev alongside app domain, indicating mixed/payment-related network contacts.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL targets https://banana.summarizer.one/uninstall — monetization/retention redirect.
• install_url_hijack crx onInstalled opens a third-party URL; target null but flag set true in manifest data.
• generic_privacy_policy store Privacy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email ext_master@proton.me; no developer name; no verified business domain.
• suspicious_js_host crx pay.your-domain.com in js_external_hosts — placeholder payment domain is anomalous for a photo editor.
• amplitude_telemetry manifest host_permissions include api.eu.amplitude.com — analytics/telemetry sent off-device.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit policy declared.
• geo_diversity api JS hosts span 4 countries (CA, DE, NL, US); category AI — triggers +1.5 network geo penalty.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• unlimitedStorage low Expands storage quota; no data exfil capability alone.
• offscreen low Creates hidden document; can be abused but no high-risk API pairing here.
• https://banana.summarizer.one/* medium Scoped host access to developer's own domain; acceptable but unverified.
• https://api.eu.amplitude.com/* medium Analytics/telemetry endpoint; signals user data is sent to third party.

Pillar Scores

Bookkeeping