Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer uses free-webmail (Gmail) with no verified business identity, raising supply-chain transfer risk.
• Content scripts inject into all http/https/file URLs giving broad page reach with no CSP declared.
• 12 external JS hosts referenced (docs, tutorials, search engines) — unusual count for a simple search utility.
• No CSP on MV3 extension with broad content-script reach; no obfuscation or active threats detected but surface is wide.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• free_webmail_developer store Developer email progrper@gmail.com; no verified publisher badge; no business domain.
• content_scripts_broad manifest Content scripts match http://*/* and https://*/* — all web pages.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• js_external_hosts_count crx 12 external hosts in JS files including github.com, stackoverflow.com, youtube.com — likely documentation links.
• featured_by_google store is_featured_by_google=true; follows recommended practices badge present.
• no_code_findings crx code_findings_raw empty; obfuscation_score 0.0; no exfil or eval patterns detected.
• no_cve_findings crx cve_findings_raw empty; jquery 3.6.4 bundled with no known CVEs at this version.

Permissions Breakdown

• contextMenus low Core to selection-search UX; adds right-click search menu.
• storage low Stores user preferences locally.
• notifications low Can push browser notifications; minor annoyance risk.
• clipboardWrite medium Can write to clipboard without user gesture; potential data injection.
• tabs medium Can read tab URLs and open new tabs; moderate info-disclosure risk.
• offscreen low Used for background DOM operations; low standalone risk.
• content_scripts: http://*/* https://*/* file://*/* medium Injects JS into all pages; broad reach but matches stated search function.
• host_permissions: https://s2.googleusercontent.com/s2/favicons* low Narrow Google favicon API; no sensitive data access.

Pillar Scores

Bookkeeping