Top Risks

• cookies permission grants full read/write access to all browser cookies across all sites.
• Developer uses free Gmail address with no verified business identity; no developer name listed.
• 28 months since last update — stale for a 2M-install extension.
• Privacy policy fetched but scope_extension=false and does not confirm data_collection=false explicitly for this extension; third_party_silence=true adds uncertainty.
• 11 external JS hosts referenced (affiliate/sponsor links visible); no CSP on MV3 — network surface broader than expected.

Evidence

• cookies_permission manifest cookies permission declared with no host_permissions — applies to all domains accessible to the browser.
• free_webmail_dev store Developer email christopheextensions@gmail.com; developer_name empty; no verified publisher badge.
• stale_extension store Last updated February 2024, 28 months ago; 2M installs creates large attack surface if compromised.
• privacy_policy_scope api Policy fetched (879 chars) but scope_extension=false; data_collection=false, retention=false, third_party_silence=true.
• external_hosts crx 11 external hosts including aurainc.sjv.io, skillshare.eqcm.net, namecheap.pxf.io — affiliate/sponsor link domains.
• geo_diversity api JS hosts span 4 countries (CA, IE, IN, US); triggers +1.5 network penalty for DeveloperTools category.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty — clean code scan.
• verified_publisher store verified_publisher=true but months_since_update=28 >18mo triggers invariant 0c; discount capped at -1.0.

Permissions Breakdown

• cookies high Full read/write access to all browser cookies; core to stated function but high abuse potential.
• tabs medium Access to tab URLs and metadata; needed to scope cookie editing to active tab.
• storage low Local extension storage for preferences; low inherent risk.
• sidePanel low Displays extension UI in side panel; no data access.

Pillar Scores

Bookkeeping