Top Risks

• cookies + <all_urls> + webRequest: can read cookies and observe requests on every site the user visits.
• Privacy policy URL returned HTTP error (fetch_error) — policy could not be verified; scored as unfetched (+10).
• brand_mention.is_impersonation=true (Meta mentioned) by unverified publisher — potential brand abuse.
• Uninstall URL hijack detected — extension registers a 3rd-party uninstall redirect.
• No CSP + innerHTML user-controlled sink: DOM-XSS risk amplified by absence of content security policy.

Evidence

• broad_host_cookies_webrequest manifest cookies + webRequest + <all_urls> + content_scripts *://*/* — full read access to all sites and cookies.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (fetch_error:HTTPError) — policy unverifiable, scored +10.
• brand_impersonation store brand_mention.is_impersonation=true, brands=[meta], not verified/featured publisher.
• uninstall_url_hijack crx uninstall_url_hijack=true — extension sets uninstall redirect URL to 3rd party.
• no_csp_innerhtml_sink crx csp_present=false AND dom_sink_innerhtml_userctrl in popup.min.js — DOM-XSS risk elevated.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true — partial trust signal.
• developer_name_missing store developer_name is empty string — no visible 'Offered by' name in listing.
• no_csp_mv3 manifest MV3 extension with no content_security_policy declared — no strict CSP protections.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata across all open tabs.
• cookies high Can read/write cookies; paired with <all_urls> this is maximum-reach cookie access.
• storage low Extension-local storage only.
• webRequest high Can observe all HTTP request details across all sites.
• activeTab low Limited to currently active tab on user gesture.
• *://*/* high Broad host permission granting access to all HTTP/HTTPS sites.
• <all_urls> high Redundant broad host access; covers all schemes including file://.
• content_scripts *://*/* high Content scripts injected into every page the user visits.

Pillar Scores

Bookkeeping