Top Risks

• Brand impersonation: uses 'Gemini' and 'Google' branding from unverified gmail developer with no confirmed ownership.
• Code executes new Function(code) — arbitrary JS execution inside sandbox; high-severity capability for a tiny-install extension.
• Privacy policy is Google's generic account policy — not scoped to this extension, collects data, shares with third parties.
• innerHTML sink in content-script injected into gemini.google.com — DOM-XSS risk on AI platform.
• Sandbox CSP allows unsafe-eval and unsafe-inline in script-src, undermining isolation.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands=['google','gemini']; dev is gmail user, confirmed_owner=false.
• function_constructor_exec crx inject/sandbox.js: new Function(code) — executes arbitrary user-supplied code at runtime.
• dom_xss_sink crx gemini-inject.js: container.innerHTML=html with no CSP guard on page-level — DOM-XSS sink.
• generic_privacy_policy store Privacy policy is myaccount.google.com generic policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• sandbox_csp_unsafe manifest sandbox CSP includes unsafe-eval and unsafe-inline on script-src, defeating sandbox isolation.
• free_webmail_developer store Developer email ai.vveselov@gmail.com; no business website; unverified publisher.
• external_host_xkcd crx js_external_hosts includes xkcd.com — unusual for an AI code editor; possibly leftover or unexpected.
• tiny_install_count store Only 18 installs; low adoption limits blast radius but provides no trust signal.

Permissions Breakdown

• host_permissions: https://gemini.google.com/* medium Narrow host scope to gemini.google.com only; matches stated function but enables content injection.
• content_scripts: https://gemini.google.com/* medium Script injection into Gemini pages; scoped but enables DOM manipulation on AI platform.

Pillar Scores

Bookkeeping