Top Risks

• Abandoned: last updated 43 months ago, no updates since Nov 2022.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Developer is a free-webmail (Gmail) address with no verified business identity.
• No content security policy declared (MV3 default mitigates but adds no explicit protection).
• Featured badge noted but extension is unmaintained and policy is inadequate.

Evidence

• last_updated store November 9, 2022 — 43 months stale; maintenance pillar = 10.0.
• privacy_policy_inadequate api Points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• free_webmail_developer store Developer email mrjohnwiseman@gmail.com — free webmail, no business domain → reputation penalty.
• is_featured_by_google store Featured badge present — reputation discount applied (-2.0).
• no_csp manifest content_security_policy is null; MV3 strict default applies so no network pillar penalty.
• code_findings_clean crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts — code quality pillar = 0.0.
• cve_findings_clean crx cve_findings_raw empty — CVE pillar = 0.0.
• low_install_count store 177 installs; no install anomaly flagged, no sibling extensions.

Permissions Breakdown

• storage low Stores blocked-site lists locally; minimal risk.
• tabs medium Can read tab URLs; needed for site-blocking but enables browsing history inference.
• notifications low Can push notifications; low standalone risk.

Pillar Scores

Scoring History

Bookkeeping