Top Risks

• nativeMessaging to local OS app creates high-capability channel; mitigated by recognized publisher check but unverified_publisher flag is set.
• Extension last updated 31 months ago (Nov 2023) — stale for a 7M-install extension; no security patches applied in that window.
• Privacy policy is Apple's generic corporate policy, not scoped to this extension; data collection admitted without extension-specific retention disclosure.
• No CSP declared (MV3 so no +2 penalty, but combined with nativeMessaging raises residual risk).
• Operator cluster shows 1 sibling extension under same fingerprint — low concern but noted.

Evidence

• nativeMessaging + publisher_recognized crx nativeMessaging declared; native_messaging_check.publisher_recognized=true, mitigating +3.0 Permissions penalty.
• maintenance_stale store Last updated Nov 2023, 31 months ago. Pillar score +8.5 (24-36mo band).
• privacy_policy_generic store Apple corporate privacy policy: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=false → +9.0 Privacy.
• developer_identity store Developer is Apple Inc. (apple.com resolves, not throwaway). verified_publisher=false, not featured.
• operator_cluster api sibling_count=1 under support@apple.com fingerprint (iCloud Passwords sibling). +2.5 Webstore.
• installs_reach store 7,000,000 installs → +1.0 (>1M) + +1.0 (>100K) + +1.0 (>10K) Webstore; -0.5 popularity-trust not applied (rating 3.4 < 4.0).
• code_quality_clean crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty. Code Quality = 0.0.
• cve_none crx cve_findings_raw empty. CVE pillar = 0.0.

Permissions Breakdown

• bookmarks medium Read/write access to all bookmarks; core to stated function.
• nativeMessaging high Allows communication with native app on host OS; broad OS-level channel. Publisher recognized per native_messaging_check.
• storage low Local extension storage only; low-risk data persistence.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• pejdijmoenmkgeppbflobdenhhabjlaj

Scoring History

Bookkeeping