Top Risks

• Privacy policy is Google's generic policy — does not scope data collection to this extension at all.
• Extension last updated 25 months ago; effectively stale/abandoned.
• Developer domain currencyconverter.com does not resolve; no accountable party reachable.
• Manifest uses i18n placeholders for name/description, obscuring declared identity.
• No CSP declared; MV3 default mitigates but external JS host (openexchangerates.org) adds minor surface.

Evidence

• generic_privacy_policy store Privacy URL points to Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true); +10.0 privacy per v3.5 rule D.
• stale_extension store months_since_update=25; falls in 24-36mo band → +8.5 maintenance.
• developer_domain_not_resolving api currencyconverter.com resolves=false; developer uncontactable, no governance anchor.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; reputation starts at 5.0 with no discounts.
• obfuscation_absent_code_clean crx obfuscation_score=0.0, code_findings_raw=[], 5 JS files scanned; code quality pillar=0.
• external_js_host crx js_external_hosts=[openexchangerates.org]; legitimate currency API, no bad-host hit, minor network surface.
• i18n_manifest_placeholders manifest manifest_name=__MSG_appName__, manifest_description=__MSG_shortDesc__; identity obscured in manifest.
• low_install_count store 2,000 installs; below 10K threshold, no install-count amplifier applied.

Permissions Breakdown

• storage low Stores extension preferences/cached rates locally; no cross-site data exposure.

Pillar Scores

Bookkeeping