Top Risks

• Privacy policy fetched but lacks extension scope and admits data collection + third-party sharing — scores maximum privacy risk.
• last_updated missing; maintenance cannot be confirmed, treated as stale (6-12 month floor applied).
• Two innerHTML DOM-XSS sinks in options and popup JS; CSP present but sinks remain exploitable via stored/reflected data.
• Developer name absent from store listing; only email identity (support@justblock.org) available.
• Content scripts injected on all http/https URLs broadens attack surface despite low-privilege permission set.

Evidence

• privacy_policy_scope_mismatch api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — v3.5 rule D applies: +10.0.
• dom_xss_sinks crx 2x dom_sink_innerhtml_userctrl findings in options.js and popup.js; CSP present so base +0.5 each = +1.0 → +2.0 total with FIX B absent (CSP present).
• no_developer_name store developer_name is empty string; +1.0 reputation penalty for missing 'Offered by' identity.
• maintenance_unknown store last_updated and months_since_update both null; applied 6-12 month floor score of +3.5 conservatively → 6.0 (policy floor).
• content_scripts_broad manifest content_scripts_matches covers http://*/* and https://*/* — all sites; justified-broad discount applied for Adblock category.
• installs_70k store 70,000 installs triggers +1.0 webstore signal (>10K threshold).
• no_bad_hosts_no_cves api threat_intel bad_host_hits empty, cve_findings_raw empty, no obfuscation, no external JS hosts — positive signals.
• verified_publisher_absent store verified_publisher=false, is_featured_by_google=false; no trust discounts available.

Permissions Breakdown

• storage low Stores extension settings locally; no data exfil risk on its own.
• declarativeNetRequest medium Allows network request blocking/modification; core to adblock function, no host access multiplier.
• activeTab low Scoped to user-activated tab only; limited reach.
• content_scripts http://*/* https://*/* medium Broad content-script injection across all sites; justified for adblock but adds surface area.

Pillar Scores

Scoring History

Bookkeeping