Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing (→ Privacy +10.0).
• Extension last updated 24 months ago; broad host access + webRequest left unpatched for extended period.
• install_url_hijack active: onInstalled opens i-dont-care-about-cookies.eu — third-party URL open on install (+2.0 Webstore).
• webRequest + scripting + *://*/* combination grants full read/modify capability on every page visited.
• No CSP declared (MV3 mitigates somewhat, but absence noted alongside broad host permissions).

Evidence

• privacy_policy_generic store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 D).
• install_url_hijack crx onInstalled opens https://www.i-dont-care-about-cookies.eu/report/ — third-party URL hijack → +2.0 Webstore.
• maintenance_stale store months_since_update=24 → Maintenance +6.0 (12-24mo band).
• broad_host_webrequest manifest webRequest + scripting paired with *://*/* = full page read/modify on all sites; category discount applied.
• developer_recognized_org store GEN Digital Inc. / nortonlifelock.com is a recognized security organization; -2.0 Reputation, but 0c cap applies (months_since_update=24 >18mo).
• featured_by_google store is_featured_by_google=true → -2.0 Reputation discount applied.
• no_cve_no_obfuscation crx cve_findings_raw=[], code_findings_raw=[], obfuscation_score=0.0 → Code Quality 0.0, CVE pillar 0.0.
• operator_cluster_clean api sibling_count=0, bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — no monetization shell signals.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; medium risk on its own.
• storage low Persists extension settings locally; low risk.
• notifications low Can show desktop notifications; low risk alone.
• webRequest high Observe/intercept all network requests across all sites.
• webNavigation medium Tracks navigation events; moderate risk.
• declarativeNetRequest medium Block/redirect requests declaratively; appropriate for ad/cookie tool.
• scripting high Inject scripts into any page due to *://*/* host permission.
• *://*/* high Broad host access — enables script injection and request observation on all sites.

Pillar Scores

Scoring History

Bookkeeping