Top Risks

• Generic Google privacy policy does not scope data collection to this extension — admits collection and 3rd-party sharing.
• <all_urls> + webRequest + scripting + pageCapture combination gives broad capability over every site visited.
• developer_name field is empty in listing metadata; no verified publisher badge.
• privacy_policy_classification: scope_extension=false, data_collection=true, third_party_sharing=true → triggers +10 privacy pillar.
• Rating 3.9 at 5M installs indicates some user dissatisfaction; no red-flag reviews detected but warrants monitoring.

Evidence

• host_permissions_all_urls manifest <all_urls> host permission granted; amplifies webRequest, scripting, pageCapture by ×1.2.
• privacy_policy_generic_google store Policy at policies.google.com: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• developer_identity store developer_email=drive-extension-support@google.com; developer_name empty; brand_mention confirmed_owner=true, not impersonation.
• recognized_org_discount store google.com domain, confirmed_owner; -2.0 reputation discount applied (capability gate: HIGH perms present, caps to -1.0 per 0b).
• csp_absent_mv3 manifest content_security_policy=null; MV3 has strict default so +2.0 MV2 network penalty does NOT apply.
• code_findings_empty crx code_findings_raw=[]; obfuscation_score=0.0; no malicious signals detected.
• cve_findings_empty crx cve_findings_raw=[]; no known vulnerable libraries detected.
• maintenance_3_6mo store months_since_update=11; falls in 6-12mo band → +3.5.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low data risk.
• identity medium Can obtain OAuth tokens for signed-in Google account.
• printerProvider low Enables print-to-Drive; narrow scope.
• notifications low Shows desktop notifications; no data exfil risk alone.
• pageCapture high Can capture full page content as MHTML — high data access.
• storage low Local extension storage; low risk.
• tabs medium Access to tab URLs and titles across all open tabs.
• webRequest high Observe all network requests; paired with <all_urls> elevates risk.
• scripting high Can inject scripts into any page when combined with <all_urls>.
• <all_urls> high Broad host access amplifies webRequest, scripting, pageCapture risk.

Pillar Scores

Bookkeeping