Top Risks

• Brand impersonation: title uses 'Google Chrome™' trademark; developer is unverified gmail user with no confirmed ownership.
• Privacy policy admits data collection and third-party sharing without scoping to this extension — worst-case disclosure.
• Free-webmail dev email (alexeystore4@gmail.com) with no verified business domain raises accountability concerns.
• manifest_source is html_fallback — actual permissions unknown, CRX not inspected.
• 200K installs at 3.2 rating with no business identity creates significant reach with low governance.

Evidence

• brand_impersonation store Title contains 'Google Chrome™'; brand_mention.is_impersonation=true, confirmed_owner=false, dev domain is gmail.com.
• free_webmail_dev store Developer email alexeystore4@gmail.com is free webmail; no business website verifiable.
• privacy_policy_generic_admit api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy score (v3.5 rule D).
• manifest_html_fallback store manifest_source=html_fallback with 200K installs; actual permissions not inspectable — partial data risk.
• low_rating store Rating 3.2; no review red flags matched but below 4.0 threshold suggests user dissatisfaction.
• is_featured_by_google store Extension carries Google Featured badge, partially mitigating reputation risk despite unverified publisher.
• no_code_surface crx js_files_scanned=0, obfuscation_score=0.0, code_findings_raw empty — CRX not analysed, code quality defaulted to 0.
• operator_cluster_clean api sibling_count=0; no related extensions under same fingerprint detected.

Pillar Scores

Scoring History

Bookkeeping