Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Begranda Conciliador Dian [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and third-party sharing (+10 privacy pillar).
• No developer name, email, or install/rating data available — identity unverifiable.
• Extension contacts developer backend (dianextractor.begranda.com) with no CSP; data sync destination unaudited.
• No last_updated date — maintenance status unknown, cannot rule out abandonment.

Evidence

• privacy_policy_generic store Privacy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_identity store developer_name, developer_email, title, installs, and rating all missing — no verifiable publisher identity.
• developer_backend_host manifest host_permissions include dianextractor.begranda.com; JS contacts this host alongside DIAN gov domains.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction declared.
• localhost_host_permission manifest Permissions include http://localhost:8000/* and http://127.0.0.1:8000/* suggesting dev/debug build.
• no_cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; no eval, remote loading, or exfil signals.
• no_bad_hosts api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty; operator sibling_count=0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Begranda Conciliador Dian [data-theft] + malext.io malicious_extension_sentry; score 3.19 -> 5.69 (+2.5 cap 2.5).

Permissions Breakdown

• activeTab low Grants access only to the current tab on user action; minimal scope.
• declarativeNetRequest medium Can block/redirect network requests; scoped here to specific DIAN domains.
• scripting medium Can inject scripts into pages; mitigated by narrow host_permissions scope.
• host: catalogo-vpfe.dian.gov.co/* low Colombian tax authority domain; matches stated function.
• host: certificate-vpfe.dian.gov.co/* low Colombian tax certificate domain; matches stated function.
• host: http://localhost:8000/* low Local dev server access; not reachable externally.
• host: http://127.0.0.1:8000/* low Loopback access; not exfiltration risk in isolation.
• host: https://dianextractor.begranda.com/* medium Developer-controlled backend; unverified domain, data sync destination.

Pillar Scores

Bookkeeping