Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Словарёк [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Broad host_permissions (http://*/* + https://*/*) with scripting allow injection into every page; no CSP.
• Privacy policy has length=21 (effectively empty), not scoped to extension, third-party silence.
• Free-webmail dev (gmail), no developer name — anonymous publisher with broad reach.
• Uninstall URL hijack flag set — extension registers an uninstall redirect to unknown third-party URL.

Evidence

• broad_host_permissions manifest host_permissions include http://*/* and https://*/*, enabling scripting injection on all sites.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but hijack flag present, indicating 3rd-party redirect on removal.
• privacy_policy_inadequate api Policy length=21 chars, scope_extension=false, data_collection=false, third_party_silence=true.
• anonymous_developer store developer_name empty; email robertblind91@gmail.com (free webmail); no business identity.
• external_js_host crx js_external_hosts: api.slovarek.hrprime.ru and vuejs.org contacted; no CSP to restrict.
• no_csp manifest content_security_policy null; csp_present=false on MV3 extension with broad hosts and scripting.
• verified_publisher_gmail store verified_publisher=true but email is free gmail; no developer domain resolved or confirmed.
• geo_diversity api JS hosts span CA and RU (country_count=2); hrprime.ru is .ru TLD with Russian-hosted API.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Словарёк [data-theft] + malext.io malicious_extension_sentry; score 4.48 -> 6.98 (+2.5 cap 2.5).

Permissions Breakdown

• scripting medium Can inject JS into any page given broad host permissions.
• storage low Local storage only; low inherent risk.
• http://*/* high Broad host access across all HTTP sites.
• https://*/* high Broad host access across all HTTPS sites.

Pillar Scores

Bookkeeping