Top Risks

• Free-webmail dev (gmail) with no developer name raises accountability concern.
• webRequest + scripting + <all_urls>: full read/intercept capability on every site visited.
• No CSP: DOM-XSS sink (innerHTML) in popup.js has no mitigating policy.
• Privacy policy present but lacks data retention disclosure and third-party sharing is silent.
• Verified publisher / featured badges mitigate but do not eliminate broad-capability risk.

Evidence

• free_webmail_developer store Developer email santosewilliames841@gmail.com with no developer name and no verified business.
• broad_host_access manifest <all_urls> in host_permissions and content_scripts_matches; paired with webRequest and scripting.
• no_csp crx content_security_policy is null; no CSP present for MV3 extension.
• dom_xss_sink crx innerHTML used on variable in scripts/popup.js without CSP or sanitisation — DOM-XSS risk.
• verified_and_featured store verified_publisher=true and is_featured_by_google=true; applied Reputation discounts.
• privacy_policy_gaps api Policy scoped to extension, data_collection=true, but retention=false and third_party_silence=true.
• js_external_hosts crx External hosts listed: api.x.com, jquery.com, reactjs.org (6 domains); 2 countries CA/US.
• maintenance_recent store Last updated January 18, 2026 (5 months ago); 3-6mo band applies (+1.5).

CVE Exposures (3)

Permissions Breakdown

• downloads medium Can save files to disk; fits VideoDownloader category.
• storage low Local extension storage only.
• webRequest high Can observe all network traffic across all URLs; paired with <all_urls>.
• tabs medium Can read tab URLs and metadata.
• scripting high Can inject JS into any page; paired with <all_urls> host permission.
• <all_urls> (host_permission) high Broad host access amplifies webRequest and scripting risk across every site.
• <all_urls> (content_scripts) high Content script injected on every page; -1.5 justified-broad discount applied for VideoDownloader.

Pillar Scores

Scoring History

Bookkeeping