Top Risks

• manifest_source is html_fallback — no CRX scanned; permissions and code surface unknown
• No developer name listed in store; identity accountability reduced
• Privacy policy covers data collection and third-party sharing; scoped but warrants review
• Description-permission mismatch flagged: claims ad-blocking but declarativeNetRequest/webRequest not confirmed from manifest
• 62M installs creates large blast radius if extension is ever compromised or sold

Evidence

• manifest_source=html_fallback store No CRX available; permissions, host_permissions, and code could not be directly verified. All permission scores set to 0.
• description_promise_mismatch store Store claims ad-blocking but declarativeNetRequest/webRequest not confirmed in manifest due to html_fallback source.
• privacy_policy_classification api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true, third_party_silence=false.
• no_developer_name store developer_name field is empty; reduces identity accountability.
• large_install_base store 62M installs; blast radius is very high if extension is compromised or ownership transferred.
• threat_intel_clean api No bad_host_hits, monetization_hits, or affiliate_hits detected. Developer domain resolves and is not throwaway.
• no_cve_findings api cve_findings_raw is empty; no vulnerable bundled libraries identified.
• review_red_flags_clean store review_red_flags.match_count=0; no redirect/malware/spam patterns in reviews.

Pillar Scores

Scoring History

Bookkeeping