Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Free-webmail developer (gmail) with no business domain; no verified publisher badge; very low install count (4).
• Host permission <all_urls> paired with declarativeNetRequest gives capability to block/redirect any site traffic.
• new Function() constructor detected in background.js and vendor.js — eval-capable code path present.
• Extension last updated 14 months ago with only 4 installs; tail-attack-surface anomaly flagged.

Evidence

• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — D(v3.5) applies: +10.0.
• free_webmail_dev store Developer email hunkiepeanut.dev@gmail.com; no business domain; no verified publisher — Reputation floor at 7.5.
• host_permissions_all_urls manifest <all_urls> host permission grants broad reach for declarativeNetRequest and tabs across every site.
• function_constructor crx new Function() in background.js and vendor.js; obfuscation_score=0; likely eval-support detection in bundled lib.
• install_perm_anomaly api 4 installs with HIGH-tier host permission; small_install_high_perm=true, tail_attack_surface=true.
• maintenance_stale store 14 months since last update; 6-12mo band = +3.5; MV3 mitigates some risk.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 (strict default applies; no MV2 penalty).
• no_bad_hosts_or_cves crx bad_host_hits, monetization_hits, affiliate_hits, cve_findings_raw all empty; no external JS hosts.

Permissions Breakdown

• storage low Stores extension settings locally; low direct harm potential.
• declarativeNetRequest medium Can block/redirect network requests; appropriate for site-blocker but notable capability.
• tabs medium Can read tab URLs and metadata across all tabs; moderate surveillance surface.
• <all_urls> (host_permission) high Grants declarativeNetRequest and tabs access across every site; broad reach.

Pillar Scores

Bookkeeping