Top Risks

• Privacy policy admits data collection and third-party sharing without extension-specific scope
• Broad content script injection on all URLs enables comprehensive browsing tracking
• Unverifiable developer identity using free Gmail address
• Extension unmaintained for 13 months
• Install URL hijack redirects users post-installation

Evidence

• privacy_policy_classification crx scope_extension=false, data_collection=true, third_party_sharing=true
• developer_email store Free Gmail address (multivariateaisolutions@gmail.com) without verified business
• months_since_update store 13 months since last update (September 1, 2025)
• install_url_hijack manifest onInstalled triggers external URL redirect
• content_scripts_matches manifest <all_urls> broad host access
• code_findings crx function_constructor in sentry.js (new Function constructor)
• js_external_hosts crx Contacts sheets.googleapis.com and www.nextgrowthlabs.com

Permissions Breakdown

• tabs medium Required for tab suspension functionality to monitor and suspend tabs.
• storage low Local storage for extension settings and suspended tab state.
• identity low Authentication for Google Sheets API integration.
• scripting medium Programmatic injection into tabs for suspension state management.
• activeTab low Temporary access to active tab for immediate user actions.
• host_permissions:https://sheets.googleapis.com/v4/spreadsheets/* low Specific Google Sheets API scope for data export features.
• content_scripts_matches:<all_urls> high Broad content script injection on all URLs enables tracking across all sites.

Pillar Scores

Bookkeeping