Top Risks

• Brand impersonation: 'for Google' title from unaffiliated wwevents.fun domain
• <all_urls> host access far exceeds stated Google Chat/Meet scope
• Payment endpoints pay.wwevents.fun / pay.oinkandstuff.com loaded in extension JS
• Install-URL hijack opens chrome://settings/system on install
• DOM-XSS innerHTML sink in bundled mootools-core.js

Evidence

• brand_impersonation api brand_mention.is_impersonation=true; google brand, dev domain wwevents.fun not confirmed owner
• scope_mismatch crx <all_urls> in host_permissions while content_scripts are scoped to google.com properties only
• install_url_hijack crx onInstalled opens chrome://settings/system (browser-internal target)
• payment_hosts crx JS references pay.wwevents.fun and pay.oinkandstuff.com monetization endpoints
• verified_featured store Verified publisher + Featured by Google badges present
• code_finding crx innerHTML user-controlled sink in options/lib/mootools-core.js; CSP present, no eval
• privacy_policy api Scoped policy fetched: collection, retention, third-party sharing all disclosed
• maintenance store Updated 0 months ago; MV3; jquery 3.7.1; no CVEs flagged

Permissions Breakdown

• system.display low Display info only, not in rubric HIGH/MEDIUM list
• scripting medium Can inject and execute scripts in pages
• activeTab low Temporary access to active tab only
• notifications low No host pairing making it medium
• contextMenus low Menu integration only
• unlimitedStorage low Local storage quota only
• storage low Local settings storage
• <all_urls> high Host access to every site; user data readable anywhere

Pillar Scores

Bookkeeping