Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; data collection and third-party sharing admitted.
• Content scripts declared for <all_urls> giving broad page-level reach across all sites.
• No CSP present: innerHTML sinks and new Function() in bundled deps run without sandbox protection.
• Developer uses free webmail (gmail) with no business domain or verified publisher status.
• Extension stale at 18 months; no changelog visible.

Evidence

• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 Privacy.
• content_scripts_all_urls manifest content_scripts_matches=[<all_urls>] with no host_permissions; broad passive reach on every site.
• no_csp crx csp_present=false; innerHTML and new Function() findings unmitigated.
• function_constructor crx new Function() in dep/jszip.js; +2.5 code quality per debugger_attach/function_constructor rule.
• dom_sink_innerhtml_userctrl_no_csp crx innerHTML sink in emoji-picker-element with csp_present=false triggers +2.0 FIX-B uplift.
• free_webmail_dev store Developer email sourcemile@gmail.com; no verified publisher, no business domain.
• maintenance_stale store months_since_update=18; falls in 12-24mo band → +6.0 Maintenance.
• external_cdn_hosts crx js_external_hosts includes cdn.jsdelivr.net and unpkg.com; 2 CDN origins, country_count=2.

Permissions Breakdown

• storage low Standard local data persistence; low abuse potential.
• unlimitedStorage low Extends storage quota; no data-exfil risk on its own.
• activeTab low Scoped to user-initiated tab interaction; limited reach.
• sidePanel low UI chrome only; no content access beyond activeTab.
• contextMenus low Adds right-click menu items; no data access.
• content_scripts <all_urls> medium Scripts run on every site; broad reach even without host_permissions declared.

Pillar Scores

Bookkeeping