Top Risks

• Privacy policy URL failed SSL fetch — treated as no accessible policy; data handling unknown.
• Install URL hijack: onInstalled opens speakselectiontextextension.shop, a 3rd-party domain.
• Free-webmail dev (gmail) with generic name 'Extensions' and Google Sites policy — low accountability.
• Content scripts injected on <all_urls> giving persistent access to every page visited.
• Extension contacts speakselectiontextextension.shop externally; domain ownership/intent unverified.

Evidence

• install_url_hijack crx onInstalled redirects to speakselectiontextextension.shop — 3rd-party domain, monetization risk.
• privacy_policy_fetch_failed api SSLError on https://sites.google.com/view/ext-privacypolicy77/ — policy inaccessible, scored as no policy.
• free_webmail_developer store Developer email browsnerose@gmail.com; name 'Extensions' is generic; no verified business.
• content_scripts_all_urls manifest Content scripts match <all_urls> — code runs on every site the user visits.
• js_external_host crx Extension contacts speakselectiontextextension.shop at runtime; purpose/ownership unverified.
• is_featured_by_google store Extension carries Google Featured badge — minor trust signal despite other concerns.
• no_cve_findings crx No bundled JS libraries with known CVEs detected.
• obfuscation_clean crx obfuscation_score=0.0, code_findings_raw empty — no obfuscation or exfil patterns found.

Permissions Breakdown

• contextMenus low Adds right-click menu item; core to stated TTS function.
• tts low Text-to-speech synthesis; matches stated purpose exactly.
• storage low Persists user voice/speed prefs locally.
• activeTab low Reads selected text on active tab only; narrow scope.
• content_scripts <all_urls> medium Script injected into every page; broader than activeTab alone.

Pillar Scores

Bookkeeping