Top Risks

• Brand impersonation: uses 'Google' and 'Gemini' branding; developer is not affiliated with Google.
• Privacy policy points to generic Google account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Monetization host googletagmanager.com in host_permissions enables tracking on all Google domains.
• Developer domain lf.gg flagged as throwaway-looking; no verified publisher status.
• Extension is 15 months stale; no verified publisher reduces trust in ongoing security maintenance.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; confirmed_owner=false; brands=['google','gemini']; dev domain lf.gg unrelated to Google.
• privacy_policy_generic api Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy pillar (v3.5 D).
• monetization_host manifest googletagmanager.com in both host_permissions and monetization_hits; category=AI, not Adblock/Shopping.
• throwaway_domain api threat_intel.developer_domain_info.looks_throwaway=true for lf.gg; dev not verified publisher.
• maintenance_stale store months_since_update=15; falls in 12-24mo band (+6.0 maintenance).
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust discount available.
• csp_present_mv3 manifest CSP present; script-src 'self' only; no remote code loading. No MV2+no-CSP penalty.
• code_clean crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[]; no malicious code indicators.

Permissions Breakdown

• declarativeNetRequest medium Can modify network requests declaratively; medium risk without broad host access.
• sidePanel low Renders extension UI in side panel; minimal risk.
• storage low Local extension storage; low risk.
• *://*.google.com/* medium Host access to all Google domains; scoped to stated function but broad.
• *://*.googleusercontent.com/* medium Access to user content served by Google; reasonable for Gemini but broad.
• *://*.googletagmanager.com/* high Host access to GTM; enables analytics/tracking beyond core function.

Pillar Scores

Scoring History

Bookkeeping