Top Risks

• Privacy policy is Google's own account policy — not scoped to this extension, admits data collection and third-party sharing (Privacy pillar maxed at 10).
• Broad host permissions (https://*/*, http://*/*) plus content_scripts on <all_urls> give extension access to every page the user visits.
• Developer name field is empty; 'Offered by' attribution relies solely on email domain avast.com.
• Operator cluster has 1 sibling extension under same fingerprint, slightly expanding blast radius.
• No CSP declared (MV3 default is strict but extension self-imposes no additional restriction); no code findings reduce residual concern.

Evidence

• privacy_policy_generic store Privacy URL points to myaccount.google.com — Google's own policy, not Avast's extension policy. scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_host_permissions manifest host_permissions include https://*/* and http://*/* plus content_scripts on <all_urls>; justified for security category.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount per rubric.
• no_developer_name store developer_name is empty string; identity anchored only to avast.com email domain.
• no_bad_hosts_no_cve crx bad_host_hits=[], cve_findings_raw=[], code_findings_raw=[], obfuscation_score=0.0 — clean scan.
• operator_sibling api sibling_count=1 (nbmoafcmbajniiapeidgficgifbfmjfo) under same dev-email fingerprint.
• maintenance_recent store Last updated September 24 2025; months_since_update=9, in 3-6mo band (+1.5).
• no_monetization api monetization_hits=[], affiliate_hits=[], bad_host_hits=[], js_external_hosts=[] — no ad-tech contacts detected.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; moderate risk for a security tool.
• activeTab low Scoped to user-invoked tab only; low standalone risk.
• scripting high Can inject scripts into pages; high capability, justified for security scanning.
• storage low Local extension storage; minimal risk.
• alarms low Scheduling only; no data access.
• declarativeNetRequest medium Can block/modify network requests; core to ad/threat blocking function.
• declarativeNetRequestFeedback medium Reads which rules matched; adds telemetry capability.
• https://*/* high Broad host access to all HTTPS sites; necessary for security extension but high reach.
• http://*/* high Broad host access to all HTTP sites; same justification as HTTPS.
• <all_urls> (content_scripts) high Content scripts run on every page; high reach, expected for URL-reputation scanning.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• nbmoafcmbajniiapeidgficgifbfmjfo

Scoring History

Bookkeeping