Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Broad host permissions (http://*/* + https://*/*) with scripting allow JS injection into every site visited.
• No CSP on MV3 extension combined with innerHTML DOM-XSS sink in main JS file.
• Small install base (22) with high-tier permissions flags tail-attack-surface anomaly.
• Developer identity unverified; no verified publisher badge; privacy policy mismatch is a red flag.

Evidence

• broad_host_permissions manifest content_scripts_matches and host_permissions both cover http://*/* and https://*/* — all sites.
• privacy_policy_generic store Policy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in assets/main-EUBy4tKu.js; no CSP to mitigate.
• no_csp manifest content_security_policy is null; MV3 default applies but DOM sink risk is unmitigated.
• install_perm_anomaly api 22 installs with HIGH-tier permissions flagged as small_install_high_perm=true.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; developer webozza.com resolves.
• external_host_reactjs_org crx js_external_hosts includes reactjs.org — documentation/CDN reference, low threat but noted.
• no_cve_findings crx cve_findings_raw is empty; no known-vulnerable bundled libraries detected.

Permissions Breakdown

• sidePanel low Displays extension UI in side panel; no data access risk alone.
• activeTab medium Grants temporary access to current tab; limited to user-triggered actions.
• scripting medium Can inject JS/CSS into pages; paired with broad host permissions elevates risk.
• http://*/* high Broad host access — content scripts run on all HTTP sites.
• https://*/* high Broad host access — content scripts run on all HTTPS sites.

Pillar Scores

Bookkeeping