Top Risks

• MANAGEMENT PERMISSION: extension can enumerate and disable other installed extensions (incl. security and privacy tools).
• management permission allows silently disabling/removing all other installed extensions — critical control plane.
• Uninstall and install URL hijacks redirect to extensions-manager.com; gmail dev email is unverifiable.
• Privacy policy is a generic freeprivacypolicy.com template: not scoped to this extension, admits data collection and 3rd-party sharing.
• 26 months since last update; stale MV3 extension with 100K users is acquisition/compromise target.

Evidence

• management_permission manifest management perm grants full control over all installed extensions — highest-impact single permission.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://extensions-manager.com/feedback.html (3rd-party redirect on uninstall).
• install_url_hijack crx onInstalled opens https://extensions-manager.com (3rd-party redirect on install).
• gmail_dev_no_verified_publisher store Developer email q2268444203@gmail.com with numbered alias; not a verified publisher.
• generic_privacy_policy api freeprivacypolicy.com template: scope_extension=false, data_collection=true, third_party_sharing=true.
• stale_extension store 26 months since last update with 100K installs — zombie fingerprint, high acquisition risk.
• google_analytics_telemetry crx www.google-analytics.com in js_external_hosts; telemetry-tier monetization hit.
• function_constructor crx new Function() call in vendor bundle; low-severity but noteworthy given no CSP.

Permissions Breakdown

• management high Can enable/disable/uninstall all other extensions — extremely powerful control surface.
• tabs medium Access to tab URLs and navigation; moderate risk for an extension manager.
• storage low Local data persistence; low risk on its own.
• unlimitedStorage low Removes storage quota cap; minor escalation of storage risk.

Pillar Scores

Bookkeeping