Top Risks

• debugger permission actively used: can intercept network traffic, read DOM, execute JS in any attached tab.
• cookies permission combined with debugger creates high-impact session-hijack capability.
• Privacy policy fetched but scope_extension=false and data_collection not confirmed — inadequate for this capability level.
• Two medium CVEs (i18next XSS, html-parse-stringify ReDoS) at unknown versions; no CSP amplifies DOM-XSS risk.
• install_url_hijack=true opens third-party URL on install; no developer name listed in store.

Evidence

• debugger_attach confirmed in code crx background.ts actively calls chrome.debugger.attach() — not just declared, actively exercised.
• cookies HIGH permission manifest cookies + debugger combo enables full session capture without broad host_permissions.
• No CSP present (MV3) manifest csp_present=false; MV3 has strict default but no explicit policy hardening; amplifies CVE risk.
• Privacy policy scope mismatch api Policy fetched, scope_extension=false, data_collection=false — generic, not scoped to extension.
• Two medium CVEs at unknown versions crx i18next (CVE-2017-16008 XSS) and html-parse-stringify (CVE-2021-23346 ReDoS) bundled at unknown ver.
• install_url_hijack crx onInstalled opens third-party URL — minor reputation signal but noted.
• No developer name in store listing store developer_name is empty string; reduces accountability despite business email domain.
• small_install_high_perm anomaly api Only 18 installs but holds debugger + cookies — tail attack surface noted.

CVE Exposures (2)

Permissions Breakdown

• tabs medium Can read tab URLs and metadata across sessions.
• scripting medium Allows programmatic script injection into pages.
• sidePanel low Adds a side panel UI; low standalone risk.
• storage low Local extension storage only.
• activeTab low Scoped to user-initiated tab; medium-low risk.
• debugger high Full debugger API — can intercept network, read DOM, execute arbitrary JS in any attached tab.
• cookies high Can read/write cookies for any domain, enabling session hijacking risk.

Pillar Scores

Bookkeeping