Top Risks

• Full Gmail DOM access via host perm + scripting — can read email content and compose data.
• cookies permission combined with mail.google.com host access enables session-cookie reads.
• new Function() constructor in pageWorld.js is a dynamic code execution risk if input is attacker-controlled.
• Install/uninstall URL hijack opens third-party URLs (Chrome Web Store reviews / Google Form) on lifecycle events.
• CSP script-src allows www.google-analytics.com and connect.facebook.net — remote script load surface.

Evidence

• host_permission_gmail manifest https://mail.google.com/* grants full Gmail DOM access to content scripts.
• cookies_permission manifest cookies permission paired with mail.google.com host access; session cookie exfil possible.
• csp_remote_script_src crx script-src includes https://www.google-analytics.com and https://connect.facebook.net.
• install_url_hijack crx onInstalled opens chrome.google.com/webstore reviews page — minor lifecycle hijack.
• uninstall_url_hijack crx setUninstallURL points to Google Form feedback — low-risk but flagged by rubric (+3.0 Webstore).
• function_constructor crx new Function() in pageWorld.js; dynamic code risk if shared-object input is attacker-influenced.
• verified_publisher_featured store Verified publisher + featured badge; reputation floored at 2.0 per rubric.
• privacy_policy_scoped api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; used to detect active Gmail sessions.
• cookies high Can read/write cookies; scoped to snov.io and mail.google.com host perms.
• storage low Local extension storage for settings/tracking data.
• notifications low Shows desktop alerts on email open events.
• scripting medium Injects scripts into Gmail; scoped to content_scripts_matches.
• alarms low Schedules periodic background checks for email open events.
• *://*.snov.io/* medium Host perm to own backend; expected for email tracker SaaS.
• https://mail.google.com/* high Full access to Gmail DOM — reads email content, recipients, compose data.

Pillar Scores

Bookkeeping