Top Risks

• nativeMessaging with unrecognized publisher companion app exposes OS-level attack surface.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension.
• webRequest + declarativeNetRequestWithHostAccess + <all_urls>: full traffic interception capability.
• Contacts DoubleClick (ad network) and Google Analytics — telemetry/monetization on a security tool.
• 18M installs amplify blast radius of any future supply-chain compromise or developer account takeover.

Evidence

• nativeMessaging_unrecognized_publisher crx native_messaging_check: has_native_messaging=true, publisher_recognized=false; +3.0 Permissions.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5-D).
• monetization_hits_security_category api stats.g.doubleclick.net (Google ads) + google-analytics in threat_intel.monetization_hits; +1.0 Webstore (telemetry tier).
• geo_diversity_high api JS hosts span 5 countries (IN/NL/SG/TH/US); category=Security qualifies for geo exemption — no penalty applied.
• verified_publisher store verified_publisher=true; monetization_hits non-empty → invariant 0c caps discount at -1.0 (not -3.0).
• broad_host_permissions manifest <all_urls> + content_scripts on http://* https://*; justified-broad discount applied for Security category.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0; code quality pillar = 0.00.
• recently_updated store Last updated December 2025 (~1 month ago); maintenance score = 0.00.

Permissions Breakdown

• scripting medium Can inject scripts into pages; medium risk but paired with <all_urls> raises concern.
• tabs medium Access to tab URLs and metadata across all tabs.
• nativeMessaging high Communicates with native host app; publisher_recognized=false per native_messaging_check.
• storage low Local extension storage, standard use.
• activeTab low Scoped to user-initiated interaction.
• webRequest high Can observe all HTTP requests; high capability for a security tool with <all_urls>.
• webNavigation medium Monitors navigation events across all sites.
• declarativeNetRequestWithHostAccess high Declarative network blocking/redirecting on all URLs; broad host access multiplier applies.
• alarms low Periodic background tasks only.
• <all_urls> (host_permission) high Full access to every URL visited; content scripts on http://* and https://* confirm breadth.

Pillar Scores

Bookkeeping