Top Risks

• Claims ad-blocking but lacks declarativeNetRequest/webRequest capability
• Uninstall URL redirect registered (target unknown)
• Broad external host footprint (12 domains incl. dev API endpoint)
• No developer name on listing despite verified publisher
• Privacy policy admits data collection without retention terms

Evidence

• scoped_host_access crx Host access and content scripts limited to *.youtube.com, matching stated YouTube-adblock/theme function.
• description_mismatch store Promises ad-blocking but manifest lacks declarativeNetRequest/webRequest; block mechanism unverifiable.
• uninstall_url_set crx chrome.runtime.setUninstallURL present; target not extractable.
• verified_publisher store Web Store verified publisher; dev domain bruderwebsite.de resolves; not throwaway.
• privacy_policy api Scoped to extension; discloses collection+3rd-party sharing; no retention disclosure.
• network_surface crx 12 external hosts incl. ytvapi.bruderwebsite.de; geo diversity CA/DE/US (3).
• clean_scan crx 54 JS files scanned: no findings, no obfuscation, no CVEs, no bad/monetization hosts.
• maintenance store Updated 2 months ago; actively maintained; 644 installs, rating 4.6.

Permissions Breakdown

• storage low Local settings persistence; minimal risk surface.
• host_permissions:*://*.youtube.com/* medium Read/modify YouTube pages; scoped to single stated platform.
• content_scripts:*://*.youtube.com/* medium Page DOM access on YouTube only; matches stated function.

Pillar Scores

Bookkeeping