Top Risks

• Free-webmail dev (qutorquil88@gmail.com) with no verified business identity runs extension on 100K users.
• Broad host_permissions + content_scripts on *://*/* gives full page read/modify capability across all sites.
• install_url_hijack opens 3rd-party URL on install — typical monetization/affiliate behavior.
• Description promises ad-blocking but lacks declarativeNetRequest/webRequest — functionality mismatch.
• Privacy policy discloses third-party data sharing without retention terms; no-CSP amplifies innerHTML XSS risk.

Evidence

• free_webmail_dev store Developer email qutorquil88@gmail.com; no verified business domain; numbered alias pattern.
• host_permissions_broad manifest *://*/* host_permissions + content_scripts_matches grants full cross-site access.
• install_url_hijack crx install_url_hijack=true; opens 3rd-party URL on install — monetization signal.
• description_mismatch store Promises ad-blocking but declarativeNetRequest/webRequest absent from manifest.
• dom_xss_no_csp crx 3 innerHTML user-controlled sinks across options/popup/block.js; csp_present=false amplifies risk.
• privacy_policy_third_party api Policy admits third_party_sharing=true, retention=false; scoped to extension but incomplete.
• featured_by_google store is_featured_by_google=true provides partial trust signal; no verified_publisher badge.
• js_external_hosts crx Contacts drewtools.com, fonts.googleapis.com, github.com, reactjs.org, www.w3 — 5 external hosts.

Permissions Breakdown

• tabs medium Can read tab URLs and titles — moderate surveillance capability.
• storage low Local data storage; expected for a site blocker.
• unlimitedStorage low Expanded local storage quota; low risk on its own.
• alarms low Scheduling alarms; expected for timed blocking features.
• favicon low Read favicon data; minimal risk.
• contextMenus low Adds right-click menu items; low risk.
• notifications low Shows desktop notifications; low risk.
• offscreen low Off-screen document API; limited risk in MV3 context.
• *://*/* (host_permissions) high Full access to all websites — broad read/modify of page content.
• *://*/* (content_scripts) high Scripts injected into every page; high capability for data capture.

Pillar Scores

Bookkeeping