Top Risks

• Free-webmail gmail.com developer with no verified identity — unaccountable if extension pivots maliciously.
• install_url_hijack opens YouTube on install — low-tier but indicates willingness to exploit install hook.
• js_external_hosts includes react.dev and www.youtube.com — non-adblock origins contacted at runtime.
• Content scripts injected on <all_urls> give DOM read/write capability across every visited page.
• Privacy policy admits third-party data sharing; developer identity unverified and domain unresolvable via CT.

Evidence

• free_webmail_developer store Developer email adblockforbrowser@gmail.com — free webmail, no verified business identity.
• install_url_hijack crx install_url_hijack=true; onInstalled opens https://www.youtube.com/ — monetization/tracking signal.
• external_js_hosts_mismatch crx js_external_hosts includes react.dev and www.youtube.com; neither is needed for an adblocker.
• no_csp crx content_security_policy is null (csp_present=false); MV3 default applies but no explicit hardening.
• privacy_policy_third_party_sharing api Privacy policy fetched; admits data collection AND third-party sharing; retention disclosed.
• domain_age_ct_skipped api domain_age_ct not queried because developer uses free webmail — no CT baseline available.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust signals from Google.
• install_count_moderate store 30,000 installs with broad <all_urls> host access and no developer accountability.

Permissions Breakdown

• declarativeNetRequest medium Core adblock permission; aligns with stated function; allows network request blocking rules.
• declarativeNetRequestFeedback low Read-only feedback on matched rules; low standalone risk.
• storage low Stores local settings/rules; standard low-risk permission.
• <all_urls> (host_permission) high Broad host access required for adblocker; justified but elevates risk surface.
• <all_urls> (content_scripts) high Content script injected on every site; can read/modify page DOM at scale.

Pillar Scores

Bookkeeping