Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; data collection and 3rd-party sharing admitted without extension-specific context.
• Content script injected on <all_urls> gives DOM read/write access across every site visited.
• innerHTML sink from variable in content.js creates DOM-XSS risk on every page; no CSP to mitigate.
• Unverified developer with no reputation signals; no ratings or install count to establish trust.
• No CSP defined (MV3 default applies) but DOM-XSS finding elevates residual risk.

Evidence

• content_scripts_all_urls manifest content_scripts match <all_urls> — full DOM access on every site.
• privacy_policy_generic store Policy URL is Google Account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx content.js uses innerHTML from variable; no CSP; DOM-XSS risk on all visited pages.
• no_installs_no_rating store Install count empty, rating 0 — no community trust signal available.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; developer ravendale.studio resolves but unverified.
• network_scoped manifest External hosts limited to api.dictionaryapi.dev and dict.youdao.com — matches stated translation function.
• no_cve_no_obfuscation crx cve_findings_raw empty; obfuscation_score=0.0; only 2 JS files scanned.
• maintenance_current store Last updated April 28 2026; months_since_update=3 — actively maintained.

Permissions Breakdown

• storage low Local data persistence only; no cross-site access implied.
• host_permission: https://api.dictionaryapi.dev/* low Scoped to dictionary API; matches stated function.
• host_permission: https://dict.youdao.com/* low Scoped to Youdao translation API; matches stated function.
• content_scripts: <all_urls> high Content script injected on every page; can read/manipulate all page DOM.

Pillar Scores

Bookkeeping