Top Risks

• Extreme capability set: debugger, nativeMessaging, proxy, cookies, webRequest across all sites
• eval() of variables in content scripts injects arbitrary code on visited pages
• Dynamic script src creation allows potential remote code execution
• Privacy policy fetched but not scoped to this specific extension
• Native messaging companion app publisher not recognized as verified

Evidence

• HIGH permissions + broad host access manifest debugger, proxy, nativeMessaging, cookies, webRequest paired with <all_urls> content scripts
• eval_user_input in content_script.js crx Direct eval() of variable e in content script across all sites
• script_src_dynamic in popup.js crx Dynamic <script> creation detected, potential remote loading
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variables in 3 files; DOM-XSS sinks with CSP present
• Privacy policy not scoped to extension api fetched=true, scope_extension=false, data_collection=false. Scored +9.0
• nativeMessaging publisher unrecognized api has_native_messaging=true, publisher_recognized=false (+3.0 Permissions)
• Verified publisher + featured store Both verified_publisher and is_featured_by_google are true
• Recently updated store months_since_update=0, indicating active maintenance

Permissions Breakdown

• downloads.ui low UI control for downloads manager.
• notifications low Can display desktop notifications.
• storage low Local storage access for extension data.
• tabs medium Access to tab URLs and browsing session.
• bookmarks medium Can read/modify browser bookmarks.
• clipboardRead medium Can read sensitive data copied to clipboard.
• clipboardWrite medium Can overwrite clipboard contents.
• cookies high Can read/modify session cookies for any site.
• debugger high Full DevTools protocol access; can inspect any tab.
• downloads medium Can download files silently.
• activeTab low Access to current tab on explicit invocation.
• proxy high Can intercept and route all browser traffic.
• nativeMessaging high Communicates with native OS process; deep system access.
• contextMenus low Adds items to right-click context menu.
• webRequest high Intercepts all network requests.
• webRequestAuthProvider high Can intercept proxy authentication challenges.
• sidePanel low Renders UI in Chrome side panel.
• scripting medium Can inject and execute scripts in pages.
• <all_urls> high Broad host access to every site user visits.
• content_scripts_matches <all_urls> high Auto-injects content scripts on all sites.

Pillar Scores

Bookkeeping