Top Risks

• cookies + broad twitter.com host access enables Twitter session token exfiltration by developer or future compromise
• Gmail developer address (exportmyinfohq@gmail.com), no developer name, no business identity — unverifiable actor
• Privacy policy on ext-boost.com admits data collection AND third-party sharing without retention disclosure
• Brand impersonation: mentions Twitter/X brand without confirmed ownership; unverified Gmail dev
• months_since_update unknown and no CSP — extension maintenance posture cannot be assessed

Evidence

• cookies + host_permissions on twitter.com/x.com manifest cookies permission paired with *://*.twitter.com/* and *://*.x.com/* allows full session token access.
• free_webmail_dev_no_name store Developer email is exportmyinfohq@gmail.com; developer_name is empty; no business identity verifiable.
• brand_impersonation store brand_mention.is_impersonation=true for Twitter brand; developer domain is gmail.com, confirmed_owner=false.
• privacy_policy_third_party_sharing api Policy at ext-boost.com: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_csp crx content_security_policy is null; csp_present=false on MV3 extension with DOM-XSS sink.
• dom_sink_innerhtml_userctrl crx popup.100f6462.js contains innerHTML assignment from variable — DOM-XSS risk.
• install_perm_anomaly store 727 installs with HIGH-tier permissions (cookies + broad host); small_install_high_perm=true.
• months_since_update_unknown store last_updated is empty; maintenance posture cannot be assessed — scored as 6-12 months conservatively.

Permissions Breakdown

• storage low Local extension data storage; low sensitivity.
• identity medium OAuth token access; can read user Google identity.
• identity.email medium Explicitly requests user's Google email address.
• cookies high Can read/write cookies; paired with twitter.com host access enables session token theft.
• *://*.twitter.com/* high Broad host access to Twitter/X; combined with cookies is a critical surface.
• *://*.x.com/* high Broad host access to X.com; same risk surface as twitter.com.

Pillar Scores

Bookkeeping