Top Risks

• Uninstall URL hijack present (uninstall_url_hijack=true): sends users to unknown 3rd-party URL on removal (+3.0 Webstore).
• Install URL hijack present (install_url_hijack=true): opens 3rd-party URL on install (+2.0 Webstore).
• Privacy policy fetched but scope_extension==false and data_collection==false: generic/unscoped policy (+9.0 Privacy).
• Developer email is free Gmail with no verified business domain, reducing accountability.
• No CSP on MV3 extension that contacts external hosts x.gd and xgd.io.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() points to 3rd party (target null/unknown); classic monetization/tracking pattern.
• install_url_hijack crx onInstalled opens 3rd-party URL (target null/unknown); low-effort traffic monetization indicator.
• privacy_policy_unscoped store Policy fetched (1739 chars) but scope_extension=false, data_collection=false; generic boilerplate, not extension-specific.
• free_webmail_developer store Developer email xgd.contact@gmail.com; no verified business domain raises accountability risk.
• js_external_hosts crx Extension contacts x.gd and xgd.io; these are the shortener endpoints but no CSP constrains them.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; mitigates reputation risk but does not explain URL hijacks.
• no_csp crx content_security_policy is null on MV3 extension with external JS hosts x.gd, xgd.io.
• operator_cluster_clean api sibling_count=0; no sibling extensions detected under same fingerprint.

Permissions Breakdown

• activeTab low Only accesses the current tab on user action; no persistent host access.
• storage low Local key-value storage; no cross-origin or network risk.

Pillar Scores

Bookkeeping