Top Risks

• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing==true: policy admits broad data sharing not scoped to extension.
• Broad host access (*://*/* + <all_urls>) combined with scripting and content_scripts on all URLs enables full-page read/modify on every site.
• desktopCapture permission allows full screen/window capture; high-impact if extension is ever compromised or sold.
• Brand impersonation flag: 'google' mentioned, confirmed_owner==false — potential trust confusion.
• No CSP defined (MV3 mitigates somewhat); 12 external JS hosts including jquery, mathquill — supply-chain surface.

Evidence

• privacy_policy_generic_with_sharing api Policy fetched (49KB), scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (D rule).
• broad_host_with_scripting manifest host_permissions=[*://*/*,<all_urls>] + scripting + content_scripts on all schemes; full-page access everywhere.
• brand_impersonation store brand_mention.is_impersonation=true, brands=[google], confirmed_owner=false; is_featured_by_google=true → +1.0 Reputation.
• verified_publisher_featured store verified_publisher=true + is_featured_by_google=true; discounts applied to Reputation; floor enforced at 2.0.
• no_developer_name store developer_name is empty string; partial identity gap despite verified publisher status.
• external_js_hosts_count crx 12 distinct external JS hosts (jquery, mathquill, yworks, fpdf, etc.); supply-chain exposure, no CSP.
• cve_findings_empty crx No CVEs detected in bundled libraries; jquery 3.6.3 is above known critical thresholds.
• recently_updated store months_since_update=2; Maintenance score=0.0.

Permissions Breakdown

• desktopCapture high Can capture full desktop or browser screen; core to stated function but powerful surveillance surface.
• *://*/* high Broad host access across all URLs; amplifies every other permission.
• <all_urls> high Duplicate broad host; combined with content_scripts enables injection everywhere.
• scripting high Programmatic script injection into any tab; high capability when paired with <all_urls>.
• tabs medium Access to tab URLs and metadata across all open tabs.
• webNavigation medium Can monitor navigation events across all URLs.
• activeTab low Scoped to user-activated tab; low incremental risk given <all_urls>.
• contextMenus low UI affordance only; minimal risk.
• storage low Local extension storage; standard.
• alarms low Scheduled callbacks; minimal risk.

Pillar Scores

Bookkeeping