Top Risks

• browsingData + scripting + <all_urls>: can read/modify every page and delete user browsing data.
• Privacy policy fetched but scope_extension=false with data_collection+third_party_sharing=true: admits broad data sharing without scoping to this extension (+10.0).
• Brand impersonation: mentions Google, Zoom, Discord without confirmed ownership; is_impersonation=true.
• Description promises recording but lacks tabCapture/desktopCapture — permission/feature mismatch raises shell-pattern suspicion.
• No CSP (MV3 so no +2.0 network penalty, but no script-src protection for 4 external JS hosts).

Evidence

• broad_host_permissions manifest host_permissions=[http://*/*, https://*/*] + content_scripts <all_urls> + scripting = full-page read/write on every site.
• browsingData_permission manifest browsingData declared; can erase cookies, history, cache — destructive capability mismatched to webcam-effects use case.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true. Policy does not scope collection to this extension.
• brand_impersonation store brands_mentioned=[zoom, google, discord], confirmed_owner=false, is_impersonation=true per brand_mention classifier.
• description_permission_mismatch store Promises recording but no tabCapture or desktopCapture in manifest; functional promise cannot be fulfilled.
• no_developer_name store developer_name is empty string; verified_publisher=true and is_featured=true partially mitigate.
• external_js_hosts crx 4 external JS hosts: fonts.googleapis.com, fonts.gstatic.com, vuejs.org, webcameffects.app. No CSP present.
• verified_publisher_featured store verified_publisher=true, is_featured_by_google=true; partially reduces reputation risk but does not resolve permission/privacy concerns.

Permissions Breakdown

• tabs medium Exposes URL/title of all tabs; combined with broad host access increases surveillance surface.
• activeTab low Scoped to user-invoked tab; lower risk but redundant given scripting+host_permissions.
• scripting high Allows arbitrary JS injection into any page via host_permissions <all_urls>.
• storage low Local data persistence; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; less risky than webRequest but still significant.
• browsingData high Can delete cookies, cache, history across all time ranges — destructive/exfil potential.
• http://*/* high Broad host access enabling content-script injection and data reads on all HTTP sites.
• https://*/* high Broad host access on all HTTPS sites; paired with scripting this is maximum reach.
• <all_urls> (content_scripts) high Content scripts injected into every page the user visits; high surveillance/exfil surface.

Pillar Scores

Bookkeeping