Top Risks

• Privacy policy is Google's generic policy: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy score per v3.5 rule D.
• Content scripts injected into every HTTP/HTTPS page with no declared permissions and no CSP.
• Extension last updated 25 months ago; stale for a 1M-install privacy tool.
• No developer name listed in store; only email identifier available.
• Invariant 0c applies: no verified-publisher badge, no recognized-org discount applied.

Evidence

• broad_content_scripts manifest content_scripts_matches: ['http://*/*','https://*/*'] — runs on every page, no permissions[] declared.
• no_csp manifest content_security_policy is null; MV3 default applies, no explicit CSP set.
• generic_privacy_policy store Policy is policies.google.com/privacy: scope_extension=false, data_collection=true, third_party_sharing=true → D rule +10.0.
• staleness store Last updated May 2024; 25 months since update → maintenance +6.0.
• developer_identity store developer_name empty; email ga-extension-publishers@google.com; is_featured_by_google=true; not verified_publisher.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, cve_findings_raw empty — clean scan.
• threat_intel_clean api bad_host_hits=[], affiliate_hits=[], monetization_hits=[], developer domain google.com resolves, not throwaway.
• install_scale store 1,000,000 installs; is_featured_by_google=true; operator_cluster sibling_count=0.

Permissions Breakdown

• content_scripts http://*/* high Runs JS on every HTTP page; broad content-script reach across all origins.
• content_scripts https://*/* high Runs JS on every HTTPS page; full web read access from content context.

Pillar Scores

Bookkeeping