Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Content script injected on <all_urls> with no CSP; DOM-XSS sink (innerHTML) amplifies risk on every visited page.
• Free-webmail developer (gmail) with no listed developer name; no verified business identity.
• identity permission enables OAuth token acquisition; combined with <all_urls> content script and external host contacts raises exfil concern.
• Stale by 19 months with low rating (2.4); contacts 5 external hosts including Google Analytics with no CSP boundary.

Evidence

• content_scripts_all_urls_no_csp manifest content_scripts matches <all_urls> and content_security_policy is null — no boundary on DOM manipulation.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store developer_email=njmdevelops@gmail.com; developer_name empty; no verified business identity.
• dom_xss_sink crx content.js: el.innerHTML = title — user-controlled variable written to DOM without sanitization.
• stale_extension store Last updated Nov 2024; months_since_update=19 (6–24mo band) with rating 2.4.
• external_hosts_no_csp crx 5 external JS hosts (fontawesome.com, stickynoteplus.com, accounts.google.com, etc.) with no CSP; MV3 but no policy declared.
• monetization_telemetry crx Google Analytics hit in threat_intel.monetization_hits; only telemetry tier, +1.0 Webstore.
• verified_publisher_stale_cap store verified_publisher=true but months_since_update=19 >18mo; invariant 0c caps discount at -1.0.

Permissions Breakdown

• storage low Standard local data persistence; expected for sticky notes app.
• activeTab low Access limited to currently active tab on user gesture.
• unlimitedStorage low Allows large local storage; reasonable for notes with attachments.
• contextMenus low Adds right-click menu items; minimal standalone risk.
• identity medium OAuth token access; could expose Google account identity/tokens.
• content_scripts:<all_urls> high Content script runs on every site; broad DOM read/write access.

Pillar Scores

Bookkeeping