Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Canvas Blocker & Fingerprint Protect [spyware] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail dev (binderpo343@gmail.com) with generic name 'ChromeExtensions' — low accountability.
• Content scripts run on <all_urls> giving broad reach despite minimal declared permissions.
• Privacy policy hosted on free Google Sites; lacks data retention disclosure.
• Description claims ad-blocking but lacks declarativeNetRequest/webRequest — promise/permission mismatch.

Evidence

• developer_email_free_webmail store Dev email binderpo343@gmail.com with generic name 'ChromeExtensions'; no verified business identity.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; JS injected on every page visited.
• privacy_policy_free_hosting_no_retention api Policy on sites.google.com; scope_extension=true, data_collection=true, retention=false.
• description_promise_mismatch store Description promises ad-blocking but no declarativeNetRequest or webRequest permission present.
• no_ratings_low_installs store 147 installs, 0 ratings — no community trust signal available.
• third_party_silence api Privacy policy does not address third-party data sharing despite data_collection=true.
• no_code_findings crx 0 code findings, obfuscation_score=0.0, no external JS hosts — clean static scan.
• no_bad_host_hits api threat_intel shows no bad hosts, monetization hits, or affiliate hits.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Canvas Blocker & Fingerprint Protect [spyware] + malext.io malicious_extension_sentry; score 2.88 -> 5.38 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores extension settings locally; no cross-origin data access.
• content_scripts <all_urls> medium Injects JS on every site; broad reach even without host_permissions API access.

Pillar Scores

Bookkeeping