Top Risks

• Free-webmail developer (outlook.com) with no verified business identity; unaccountable if extension is sold.
• Install-URL hijack opens third-party noads.day page on install; minor trust signal but indicates monetization intent.
• External JS host 'smartadblocker.com' is unknown third-party domain — potential future supply-chain vector.
• No CSP declared (MV3 default applies); combined with <all_urls> content scripts on all sites.
• Privacy policy lacks retention disclosure and is silent on third-party sharing despite data_collection=true.

Evidence

• developer_email_free_webmail store Developer email is noadshelp@outlook.com — free webmail, no verified business domain.
• install_url_hijack manifest onInstalled opens https://noads.day/thankyou_page/index.html — third-party redirect on install.
• external_host_unknown crx smartadblocker.com appears in js_external_hosts — unrecognized domain with no threat intel clearance.
• no_csp manifest content_security_policy is null; csp_present=false. MV3 strict default applies but no explicit policy.
• privacy_policy_retention_missing api Privacy policy fetched; scope_extension=true, data_collection=true, but retention=false and third_party_silence=true.
• is_featured_by_google store Google Featured badge present — partial trust signal offsetting free-webmail risk.
• justified_broad_access manifest Category=Adblock; <all_urls>+declarativeNetRequest matches stated function — justified-broad discount applied.
• obfuscation_clean crx obfuscation_score=0.0, code_findings_raw empty, 8 files scanned — no malicious code detected.

Permissions Breakdown

• declarativeNetRequest medium Core adblocker function; can block/redirect network requests sitewide.
• declarativeNetRequestFeedback low Read-only feedback on matched rules; low standalone risk.
• storage low Local settings persistence; standard for extensions.
• tabs medium Access to tab URLs and metadata across all tabs.
• <all_urls> (host_permission) high Broad host access required for adblocker; justified by category but high capability.

Pillar Scores

Bookkeeping