Top Risks

• proxy permission allows full rerouting of all browser traffic through any server the extension chooses
• Developer uses free Gmail address with no verified business identity; mybrowseraddon.com contact unverifiable
• Install and uninstall URL hijacks detected (targets null but hooks are present)
• Privacy policy scoped but lacks data retention disclosure and third_party_silence flag is true
• No CSP present on MV3 extension contacting external host webbrowsertools.com

Evidence

• proxy_permission manifest proxy declared — can intercept and redirect all browser HTTP/S traffic without host_permissions or <all_urls>.
• free_webmail_developer store Developer email qaro.lynnie@gmail.com is a free Gmail account; no verified business identity.
• install_url_hijack crx install_url_hijack=true; target is null but onInstalled hook exists — opens 3rd-party URL on install.
• uninstall_url_hijack crx uninstall_url_hijack=true; chrome.runtime.setUninstallURL() to 3rd party detected.
• external_host crx js_external_hosts: [webbrowsertools.com]; no CSP; MV3 but contacts external domain.
• privacy_policy_gaps api Policy fetched, scoped, no data_collection, but retention=false and third_party_silence=true.
• is_featured_by_google store Extension carries Google Featured badge — partial trust signal reducing reputation risk.
• csp_absent manifest content_security_policy is null; no CSP hardening despite external host contact.

Permissions Breakdown

• proxy high Full proxy control: can route all browser traffic through attacker-controlled server.
• storage low Local data persistence only; low standalone risk.
• notifications low Can display notifications; minor annoyance risk.

Pillar Scores

Bookkeeping