Top Risks

• Privacy policy unreachable (fetch_error) — data handling practices unknown
• Uninstall URL hijack detected — redirects users on removal
• Install URL hijack detected — opens third-party URL on installation
• Free Gmail developer email without verified business identity
• innerHTML XSS sink in convert-app.js without CSP protection

Evidence

• privacy_policy_unreachable crx Privacy policy URL returned ConnectionError during fetch — cannot verify data handling scope
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() detected with third-party target
• install_url_hijack crx onInstalled handler opens third-party URL on installation
• developer_identity store Free Gmail address (arsalan.sosa2021@gmail.com) without verified business domain
• code_finding_dom_xss crx innerHTML assignment from variable in convert-app.js — DOM-XSS sink without CSP mitigation
• code_finding_function_constructor crx new Function() constructor in jszip.min.js — dynamic code execution risk
• high_install_count store 50,000 installs with limited permission surface

Permissions Breakdown

• contextMenus low Context menu entry for Excel conversion actions.

Pillar Scores

Bookkeeping