Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, yet admits data collection and third-party sharing (+10.0 privacy).
• Broad host permissions (http://*/*, https://*/*, wss://*/*) plus scripting allow content injection on every site.
• 12 external JS hosts contacted including blockchain RPCs, Sentry telemetry, and several third-party infra domains — broad network surface.
• new Function() constructor in contentscript.js running in broad-host context is a code-execution risk.
• Not a verified publisher; privacy policy is a generic Google URL unrelated to this extension.

Evidence

• broad_host_permissions manifest host_permissions include http://*/*, https://*/*, wss://*/*giving access to all sites.
• generic_google_privacy_policy store privacy_policy_url points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor_in_content_script crx new Function() constructor found in contentscript.js which runs on all pages.
• broad_csp_connect_src crx connect-src allows 30+ distinct origins including quiknode, alchemy, infura, sentry, IPFS, rafa.ai, and wildcard *.
• 12_external_js_hosts crx js_external_hosts: etherscan, solscan, llamarpc, publicnode, blockstream, solana RPC, portaldefi.zone, portaltobitcoin.zone, etc.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; dev domain portaldefi.com resolves but not verified.
• no_cve_findings crx cve_findings_raw empty; no known CVEs in bundled libraries despite lodash/react/viem present.
• recently_updated_mv3 manifest manifest_version=3, months_since_update=2; maintenance risk low.

CVE Exposures (8)

Permissions Breakdown

• activeTab low Accesses current tab on user action only.
• scripting medium Can inject scripts into pages; paired with broad host permissions.
• storage low Local extension data storage.
• tabs medium Can read tab URLs and metadata across all tabs.
• unlimitedStorage low No data-exfil risk on its own; allows large local data.
• sidePanel low UI surface only.
• notifications low Can push system notifications; low direct risk.
• http://*/* high Broad host access: content scripts run on all HTTP sites.
• https://*/* high Broad host access: content scripts run on all HTTPS sites.
• wss://*/* high Broad WebSocket access; can intercept WS traffic on any site.

Pillar Scores

Scoring History

Bookkeeping