Top Risks

• Privacy policy fetched but not scoped to this extension and data_collection=true with third_party_silence=true.
• Extension not updated in 24 months (stale); 2M install blast radius amplifies any future compromise.
• new Function() constructor in bundled JS — dynamic code execution risk.
• innerHTML sink present; CSP is present but policy adequacy remains low.
• React version 0.20.2 detected — extremely outdated library; no CVEs found but high exploit surface.

Evidence

• privacy_policy_not_scoped api Policy fetched (13 691 chars) but scope_extension=false, data_collection=true, retention=false — generic policy.
• stale_extension store Last updated June 2024; months_since_update=24. 2M installs amplify stale risk.
• function_constructor crx new Function() in main.ff9ff9e3.js — dynamic code execution, likely React/bundler boilerplate.
• dom_sink_innerhtml crx innerHTML assignment in main.ff9ff9e3.js; CSP present (self-only) limits exploitation.
• react_outdated crx react@0.20.2 detected via license sidecar — extremely old release, no OSV CVEs flagged.
• featured_by_google store is_featured_by_google=true; provides moderate reputation trust signal.
• no_external_hosts crx js_external_hosts empty, no bad/monetization/affiliate hits — clean network surface.
• csp_present_mv3 manifest script-src 'self'; object-src 'self' — strict CSP, MV3, no remote code loading.

Permissions Breakdown

• desktopCapture medium Captures screen/audio/video; matches stated function (screen recorder). Medium risk, scoped.

Pillar Scores

Scoring History

Bookkeeping