Top Risks

• Broad host permissions (all HTTP/HTTPS) + scripting allow arbitrary content injection across every site visited.
• Privacy policy is Google's generic account policy — does not scope to this extension at all; data practices undisclosed.
• Developer is a free-webmail (gmail) individual with no verifiable business identity.
• No CSP (MV3 default applies but no explicit policy) and 12 external JS hosts including sensitive services (mail.google.com, ChatGPT).
• install_url_hijack flag is true — extension opens a URL on install, increasing monetization/tracking risk.

Evidence

• broad_host_permissions manifest host_permissions: http://*/* and https://*/* paired with scripting permission — can inject scripts on any page.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• free_webmail_developer store Developer email jacob.hilton@gmail.com; no business website; individual unverified identity.
• install_url_hijack crx install_url_hijack=true; target null but onInstalled opens third-party URL — monetization/tracking vector.
• external_js_hosts crx 12 external hosts including chatgpt.com, mail.google.com, maps.google.com — broad network reach.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src.
• featured_by_google store is_featured_by_google=true — partial trust signal; applies -2.0 reputation discount.
• cve_findings_empty crx No CVEs or code findings detected; obfuscation_score=0.0; code quality clean.

Permissions Breakdown

• tabs medium Exposes tab URLs and titles; moderate surveillance capability.
• storage low Local preference storage; minimal risk.
• contextMenus low Adds right-click menu items; low standalone risk.
• scripting high Programmatic content-script injection into any page via broad host_permissions.
• http://*/* high Broad host access covering all HTTP sites; enables read/modify of any page.
• https://*/* high Broad host access covering all HTTPS sites; enables read/modify of any page.

Pillar Scores

Bookkeeping