Top Risks

• Broad host access (http/https all URLs) combined with cookies and browsingData enables full session and history access.
• Uninstall URL hijack detected; redirects user after removal to a third-party destination.
• Privacy policy confirms data collection and third-party sharing but lacks retention disclosure.
• last_updated unknown — maintenance risk cannot be fully assessed; 6+ months stale assumed.
• CSP connect-src includes api64.com and appn.center (non-dev domains); adds external trust surface.

Evidence

• broad_host_permissions manifest host_permissions include http://*/* and https://*/* paired with cookies and browsingData.
• uninstall_url_hijack crx uninstall_url_hijack=true; target unspecified but triggers post-removal redirect.
• verified_publisher_featured store Extension has verified publisher badge and is featured by Google; strong trust signal.
• privacy_policy_third_party_sharing api Policy fetched: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• external_csp_hosts manifest CSP connect-src includes api64.com and appn.center outside developer-controlled domain.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; no malicious code indicators detected.
• maintenance_unknown store last_updated is null; cannot confirm recency — defaulting to 6-12 months stale band.
• operator_cluster_dev_email api sibling_count=0 compound; dev_email dimension shows 2 — one sibling extension under same email.

Permissions Breakdown

• tabs medium Access to tab URLs and metadata; moderate risk for a privacy-cleaning tool.
• browsingData high Can delete history, cookies, cache across all sites; core function but powerful.
• history high Full read/write access to browsing history; broad data access.
• cookies high Read/delete cookies across all origins; paired with broad host access.
• scripting medium Can inject scripts; scope limited by host_permissions.
• storage low Local extension storage; standard and low risk.
• contextMenus low Adds right-click menu items; minimal risk.
• http://*/* high Broad host access over HTTP; combined with cookies amplifies risk.
• https://*/* high Broad host access over HTTPS; combined with cookies amplifies risk.

Pillar Scores

Bookkeeping