Top Risks

• <all_urls> + scripting: extension can inject JS into every site the user visits, including banking and email.
• ChatGPT brand impersonation (confirmed by brand_mention.is_impersonation) without verified ownership; not a Google-featured exception.
• No CSP on MV3 extension with 3 innerHTML DOM-XSS sinks; elevated XSS surface on all pages.
• Content scripts injected on all Google search domains (17 locales) well beyond stated ChatGPT sidebar function.
• External JS hosts include social/form services (formspree.io, Supabase); data could leave browser without user awareness.

Evidence

• broad_host_access manifest <all_urls> in host_permissions + content_scripts; scripting permission enables JS injection on every site.
• brand_impersonation store brand_mention.is_impersonation=true for 'chatgpt'; confirmed_owner=false; not verified_publisher for brand.
• no_csp crx content_security_policy is null; 3 innerHTML sinks in code_findings_raw with no mitigating policy.
• scope_mismatch manifest Content scripts cover 17 Google search locales beyond stated ChatGPT sidebar purpose.
• external_hosts crx 8 external JS hosts including formspree.io, supabase, t.me, twitter.com, facebook.com — broad egress surface.
• privacy_policy_third_party_sharing api Policy fetched, scoped, data_collection=true, third_party_sharing=true, retention=true — marginal adequacy.
• maintenance_unknown store last_updated is empty; months_since_update=null; cannot assess staleness, scored conservatively.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; reduces reputation risk but does not clear impersonation.

Permissions Breakdown

• storage low Stores user preferences/settings; low risk in isolation.
• contextMenus low Adds right-click menu items; low standalone risk.
• declarativeNetRequest medium Can modify/block network requests; medium risk without broad host amplifier.
• sidePanel low Opens a side panel UI; low risk.
• scripting high Allows JS injection into pages; HIGH when paired with <all_urls> host permission.
• offscreen low Creates offscreen documents; low risk in isolation.
• *://*.chat.openai.com/* high Host access to ChatGPT sessions; can read credentials/conversations.
• *://*.chatgpt.com/* high Host access to chatgpt.com; same sensitive session risk.
• <all_urls> high Broad host access across all sites; amplifies scripting to full-browser reach.

Pillar Scores

Bookkeeping