Top Risks

• Privacy policy is Google's own policy — not scoped to this extension, yet admits data collection and 3rd-party sharing (D rule: +10.0 privacy).
• cookies + webRequest + scripting + *://*/* combination grants near-total browser surveillance and content manipulation on all sites.
• 5 innerHTML DOM-XSS sinks across content scripts + new Function() constructor raise code-quality concerns on a 700K-user extension.
• No developer name listed in store; email domain resolves but display identity gap weakens accountability.
• Shopping/cashback category involves affiliate tracking; verified publisher but Google privacy policy link is a red flag for data handling transparency.

Evidence

• broad_host_access manifest host_permissions *://*/* combined with cookies+webRequest+scripting covers every site the user visits.
• privacy_policy_generic store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sinks crx 5 files contain innerHTML assignments from variables (app.js, modal_redirect_feedback.js, pin_tutorial.js, popup.js, wrapper-cuponomia-ads.js).
• function_constructor crx new Function() used in google.js — dynamic code execution risk.
• verified_publisher store Extension carries verified publisher badge; domain cuponomia.com.br resolves and is not throwaway.
• no_developer_name store developer_name is empty string; reduces store-level accountability.
• high_install_count store 700,000 installs amplifies blast radius of any permission misuse.
• cve_findings_clean crx No CVEs detected in bundled libs (vue 3.5.27); cve_findings_raw empty.

Permissions Breakdown

• tabs medium Access to tab URLs/titles; needed for coupon detection but broadens data access.
• storage low Local data persistence; low risk in isolation.
• cookies high Can read/write cookies across all origins — HIGH risk, especially paired with *://*/*.
• webRequest high Observe all network requests across all URLs; significant surveillance capability.
• scripting high Programmatic script injection into any page; paired with broad host access.
• alarms low Scheduled tasks only; low direct risk.
• *://*/* high Full host access to every site visited — amplifies cookies+webRequest+scripting risk.

Pillar Scores

Bookkeeping