Top Risks

• nativeMessaging with unrecognized publisher allows arbitrary local OS command execution via companion app.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack opens webbrowsertools.com/convert-to-mp3/ on install; uninstall URL hijack also set.
• webRequest + <all_urls> + no CSP: broad passive interception of all browser traffic.
• Free-webmail developer (gmail) with 300K installs and no verified publisher badge raises governance concern.

Evidence

• native_messaging_unrecognized manifest has_native_messaging=true, publisher_recognized=false; +3.0 permissions per rubric.
• install_url_hijack crx onInstalled opens https://webbrowsertools.com/convert-to-mp3/ — 3rd-party monetization-adjacent URL.
• privacy_policy_generic_google store Policy is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• free_webmail_developer store Developer email yokris.dev@gmail.com; no verified publisher; +1.5 reputation.
• no_csp manifest content_security_policy is null; MV3 no penalty per v2b, but amplifies other risks.
• broad_host_permissions manifest <all_urls> host_permissions combined with webRequest and scripting; HIGH capability gate applies.
• js_external_hosts crx 10 distinct external hosts including s.to, webbrowsertools.com, masswerk.at; >3 domains +1.5 network.
• uninstall_url_hijack crx uninstall_url_hijack=true (target null in data); +3.0 webstore per rubric.

Permissions Breakdown

• storage low Stores extension config locally; minimal risk.
• contextMenus low Adds right-click menu items; low risk.
• nativeMessaging high Communicates with local VLC app; publisher_recognized==false adds +3.0 per rubric.
• webRequest high Observe/intercept all network requests across all URLs; broad reach.
• scripting medium Injects scripts into pages; elevated risk without CSP.
• <all_urls> high Broad host access combined with webRequest and scripting is high-risk surface.

Pillar Scores

Scoring History

Bookkeeping