Top Risks

• Uninstall and install URL hijacks: onInstalled opens cloudapi.stream and uninstall hook is set — classic traffic-monetization pattern.
• Free-webmail developer (gmail) with no verified publisher badge; very low install count (34) with broad <all_urls> host access.
• Seven external JS hosts including cloudapi.stream, goo.gl, harrytheo.com — wide network surface for an Entertainment/tarot app.
• No CSP (csp_present=false) on MV3 extension with broad host permissions and multiple external hosts.
• small_install_high_perm anomaly: only 34 installs yet claims <all_urls> host access — tail-attack-surface concern.

Evidence

• install_url_hijack crx onInstalled opens https://cloudapi.stream/install/?reason= — install URL hijack to third-party domain.
• uninstall_url_hijack crx setUninstallURL configured (target null in listing but flag true) — classic monetization shell signal.
• broad_host_access manifest <all_urls> host_permission on a tarot/entertainment extension with no content_scripts; mismatch.
• free_webmail_dev store Developer email is viktornadiezhdin@gmail.com; no verified publisher badge; developer_name=SideGames.
• external_hosts crx 7 external JS hosts: cloudapi.stream, getbootstrap.com, github.com, goo.gl, popper.js.org, ukrplace.com, harrytheo.com.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with broad host access.
• small_install_high_perm api install_perm_anomaly: 34 installs with has_high_tier_permission=true; small_install_high_perm=true.
• privacy_policy store Policy fetched, scoped, data_collection+retention+third_party_sharing all true; adequate but hosted on ukrplace.com.

Permissions Breakdown

• sidePanel low Allows extension to display UI in Chrome side panel; low direct data risk.
• tabs medium Can read tab URLs and titles; combined with <all_urls> raises risk.
• <all_urls> (host_permission) high Broad host access across all sites; enables content injection and data reads anywhere.

Pillar Scores

Bookkeeping