Top Risks

• Extension purpose is token/cookie extraction from social media accounts
• Privacy policy fetch failed; no data handling disclosure
• Install and uninstall URLs hijacked to external tool portal
• Cookies permission scoped to Facebook/Instagram Graph API endpoints

Evidence

• cookies+tabs+fb_hosts manifest Cookies permission with host access to facebook.com, instagram.com, graph.facebook.com
• privacy_policy_fetch_failed crx Privacy policy URL returned HTTPError; classification shows scope_extension=false
• install_url_hijack manifest onInstalled opens https://social.trendatelyoum.com/tools/
• uninstall_url_hijack manifest setUninstallURL points to https://social.trendatelyoum.com/tools/
• verified_publisher store Web Store verified publisher badge present
• empty_code_findings crx No obfuscation or malicious code patterns detected in 2 scanned JS files
• last_updated_missing store Unable to determine maintenance cadence

Permissions Breakdown

• cookies high High-risk permission; paired with broad FB/IG host access for token extraction.
• tabs medium Medium-risk; allows monitoring of user browsing activity.
• host_permissions:*://*.facebook.com/* high Broad host access to Facebook/Instagram APIs enables credential/token theft.

Pillar Scores

Bookkeeping