Top Risks

• onedrive.live.com flagged as known-bad host (URLHaus malware_download/phishing) in js_external_hosts.
• No content_security_policy; MV3 mitigates somewhat but broad external host list increases attack surface.
• 12 external JS hosts including github.com, dropbox.com, stackoverflow.com — unusually broad for a TTS tool.
• Privacy policy lacks retention disclosure and third-party sharing not explicitly addressed.
• Developer name absent from listing; verified publisher status partially mitigates identity gap.

Evidence

• known-bad-host api onedrive.live.com in js_external_hosts matches URLHaus malware_download/phishing entry in cve_findings_raw.
• verified_publisher+featured store Extension holds verified publisher badge and is featured by Google, reducing reputation risk.
• no_csp manifest content_security_policy is null; MV3 enforces strict defaults but no explicit CSP declared.
• broad_external_hosts crx 12 distinct external hosts: assets.lsdsoftware.com, onedrive.live.com, dropbox.com, github.com, etc.
• privacy_policy_retention_missing api Policy fetched, scoped, data_collection=true but retention=false and third_party_silence=true.
• obfuscation_clean crx obfuscation_score=0.0; code_findings_raw empty; no eval/exfil indicators detected.
• recently_updated store Last updated June 11 2026; months_since_update=0; maintenance risk minimal.
• no_developer_name store developer_name is empty string; email support@lsdsoftware.com and domain resolves.

Permissions Breakdown

• activeTab low Accesses current tab only on user action; scoped and low risk.
• contextMenus low Adds right-click menu entry; no data access implied.
• identity low No OAuth scopes declared; limited risk without broad scopes.
• offscreen low MV3 offscreen document for audio processing; expected for TTS.
• scripting medium Can inject scripts into pages, but paired only with activeTab not broad host.
• storage low Local preference storage; standard low-risk permission.
• tts low Core TTS playback API; expected for a text-to-speech extension.
• ttsEngine low Registers a TTS engine; expected for this extension category.
• https://translate.google.com/ low Narrow host permission to Google Translate only; justified for TTS translation.

Pillar Scores

Scoring History

Bookkeeping