Top Risks

• Severely stale: 41 months since last update on a high-permission privacy tool.
• Five HIGH-risk permissions (privacy, cookies, browsingData, webRequest, declarativeNetRequestWithHostAccess) with no verifiable maintainer.
• Developer is free-webmail (gmail) persona with no verified business identity.
• Privacy policy URL points to Chrome Web Store listing page, not a real policy — generic/inadequate.
• No CSP and uninstall URL hijack flag set — minor governance concern for a security-category tool.

Evidence

• stale_extension store Last updated January 2, 2023 — 41 months ago. Maintenance pillar maxed at 10.0.
• free_webmail_developer store Developer email saroyanm@gmail.com; no business domain, no verified publisher badge.
• privacy_policy_inadequate store Privacy policy URL resolves to own Web Store listing page, not a scoped policy; third_party_sharing flagged true.
• high_permissions_cluster manifest privacy + cookies + browsingData + webRequest + declarativeNetRequestWithHostAccess — five HIGH-tier permissions.
• uninstall_url_hijack crx uninstall_url_hijack == true; target null so impact unclear but pattern is flagged.
• no_csp manifest content_security_policy is null; MV3 provides some default protection but no explicit CSP declared.
• is_featured_by_google store Extension carries Google Featured badge — provides modest trust signal for permissions scope.
• clean_code_scan crx code_findings_raw empty, obfuscation_score 0.0, cve_findings_raw empty — no malicious code detected.

Permissions Breakdown

• privacy high Controls browser privacy settings (WebRTC, tracking protection, etc.) — high-impact API.
• cookies high Read/write all cookies across all domains; combined with no host_permissions still broad risk.
• browsingData high Can delete history, cache, cookies, passwords — destructive capability.
• tabs medium Access to tab URLs and metadata across all open tabs.
• webRequest high Observe all network requests; broad surveillance capability even without blocking.
• declarativeNetRequestWithHostAccess high Declarative request manipulation with host access; can redirect/block requests.
• storage low Local extension storage; low standalone risk.

Pillar Scores

Bookkeeping