Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10 privacy).
• Developer email is free webmail (hotmail.com) with no verified business identity; developer name differs from email handle.
• <all_urls> host permission grants read access to every page the user visits — high reach for a colour-picker.
• 16 months since last update; extension is in the 12-24 month stale band.
• innerHTML DOM-XSS sink detected in js/main.js with broad host access present.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• free_webmail_dev store Developer email chrisdickerson24@hotmail.com is free webmail; no business domain; name 'Walter Garcia' mismatches email handle.
• host_permissions_broad manifest <all_urls> declared in host_permissions gives access to every site the user visits.
• dom_xss_sink crx code_findings_raw: dom_sink_innerhtml_userctrl in js/main.js; CSP present so upgrade to +0.5 only (csp_present=true, no eval, no CVEs).
• js_external_host crx js_external_hosts: reactjs.org referenced; not a CDN load but an informational link; no remote script execution detected.
• maintenance_stale store months_since_update=16; falls in 12-24 month band → Maintenance pillar 6.0.
• featured_by_google store is_featured_by_google=true provides -2.0 Reputation discount; not verified publisher.
• no_bad_hosts_no_cve crx cve_findings_raw empty; bad_host_hits empty; monetization_hits empty; CVE pillar 0.0.

Permissions Breakdown

• clipboardWrite medium Can write to clipboard; reasonable for a colour-picker but carries exfil potential.
• contextMenus low Adds right-click menu items; minimal standalone risk.
• storage low Local extension storage only; low risk.
• <all_urls> high Broad host access on every site; high reach even for a colour-picker.

Pillar Scores

Bookkeeping