Top Risks

• Privacy policy admits data collection AND third-party sharing without extension-specific scope — worst-case privacy tier.
• nativeMessaging with unrecognized publisher enables arbitrary native code execution on host machine (+3.0).
• webRequest+webRequestBlocking+cookies+<all_urls> combo gives full traffic interception and cookie exfil capability.
• eval() of a variable in myrtille.js is a direct code-execution sink if external input reaches it.
• Uninstall URL hijack redirects to ietab.net page; developer name absent from store listing.

Evidence

• nativeMessaging_unrecognized_publisher crx has_native_messaging=true AND publisher_recognized=false; native companion app publisher unverified.
• privacy_policy_scope_fail api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy per v3.5 rule D.
• eval_user_input crx myrtille/myrtille.js: eval(code) inside setTimeout — direct eval of variable.
• high_permissions_broad_host manifest webRequest+webRequestBlocking+cookies+nativeMessaging+declarativeNetRequestWithHostAccess all paired with <all_urls>.
• uninstall_url_hijack store chrome.runtime.setUninstallURL targets http://www.ietab.net/ie-tab-alternatives (+3.0 webstore).
• no_developer_name store developer_name is empty string; +1.0 reputation penalty.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount.
• js_external_hosts_count crx 12 external JS hosts including dynamodb., lping.ietab.net, securetoken.googleapis.com — >3 distinct domains.

Permissions Breakdown

• tabs medium Access to tab URLs and metadata; medium risk on its own.
• storage low Local extension storage only.
• contextMenus low Adds right-click menu items; minimal risk.
• webRequest high Intercepts all HTTP/S requests; high capability combined with <all_urls>.
• webRequestBlocking high Blocks/modifies requests in-flight; critical when paired with <all_urls>.
• nativeMessaging high Executes native companion app; publisher not recognized — high risk.
• cookies high Read/write cookies on all URLs; paired with <all_urls> = ×1.2 amplifier.
• alarms low Periodic background scheduling; low impact.
• offscreen low Offscreen document for DOM ops; low standalone risk.
• declarativeNetRequestWithHostAccess high Can block/redirect network requests on all hosts.
• <all_urls> (host) high Broadest possible host access; amplifies every other high permission.

Pillar Scores

Bookkeeping