Top Risks

• Gmail dev with no business identity; privacy policy points to Google's own policy, not extension-scoped.
• Privacy policy is Google's generic account policy: scope_extension=false, admits data_collection+third_party_sharing — worst-case privacy score.
• install_url_hijack=true: extension opens a URL on install — potential onboarding redirect to 3rd party.
• Content scripts injected on <all_urls> with no CSP; innerHTML DOM-XSS sink present in bundled JS.
• 9 external JS hosts referenced; no CSP to constrain them — broad network surface for MV3 translator.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email toanrittnis@gmail.com; no verified publisher; no business domain.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens a URL — potential redirect to 3rd-party page.
• dom_xss_sink_no_csp crx innerHTML user-controlled sink in javascript/charity/index.js with csp_present=false.
• broad_host_access manifest host_permissions=[<all_urls>] + content_scripts on <all_urls>; reads/modifies all web pages.
• external_js_hosts crx 9 external hosts referenced (bootstrap, jquery, react, popper, sizzle, github, translate.google, etc.); no CSP.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; dev identity unverifiable.
• maintenance_3_6_months store months_since_update=6; in 3–6 month band, moderate staleness.

Permissions Breakdown

• contextMenus low Standard right-click menu integration; low risk.
• activeTab low Access to current tab only on user action; scoped and expected for translation.
• storage low Local settings persistence; no exfil risk alone.
• tabs medium Can read tab URLs and metadata across all open tabs.
• system.display low Read-only display info; unusual for a translator but low impact.
• declarativeNetRequest medium Can block/redirect network requests; moderate risk without webRequestBlocking.
• <all_urls> (host_permission) high Broad host access; content scripts injected on all sites. Core risk surface.

Pillar Scores

Bookkeeping