Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Twitterx Exporter Export [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• cookies + broad twitter.com host access enables Twitter session token exfiltration by developer or future compromise
• Gmail developer address (exportmyinfohq@gmail.com), no developer name, no business identity — unverifiable actor
• Privacy policy on ext-boost.com admits data collection AND third-party sharing without retention disclosure
• Brand impersonation: mentions Twitter/X brand without confirmed ownership; unverified Gmail dev

Evidence

• cookies + host_permissions on twitter.com/x.com manifest cookies permission paired with *://*.twitter.com/* and *://*.x.com/* allows full session token access.
• free_webmail_dev_no_name store Developer email is exportmyinfohq@gmail.com; developer_name is empty; no business identity verifiable.
• brand_impersonation store brand_mention.is_impersonation=true for Twitter brand; developer domain is gmail.com, confirmed_owner=false.
• privacy_policy_third_party_sharing api Policy at ext-boost.com: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_csp crx content_security_policy is null; csp_present=false on MV3 extension with DOM-XSS sink.
• dom_sink_innerhtml_userctrl crx popup.100f6462.js contains innerHTML assignment from variable — DOM-XSS risk.
• install_perm_anomaly store 727 installs with HIGH-tier permissions (cookies + broad host); small_install_high_perm=true.
• months_since_update_unknown store last_updated is empty; maintenance posture cannot be assessed — scored as 6-12 months conservatively.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Twitterx Exporter Export [data-theft] + malext.io malicious_extension_sentry; score 5.23 -> 7.73 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local extension data storage; low sensitivity.
• identity medium OAuth token access; can read user Google identity.
• identity.email medium Explicitly requests user's Google email address.
• cookies high Can read/write cookies; paired with twitter.com host access enables session token theft.
• *://*.twitter.com/* high Broad host access to Twitter/X; combined with cookies is a critical surface.
• *://*.x.com/* high Broad host access to X.com; same risk surface as twitter.com.

Pillar Scores

Bookkeeping