Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension at all.
• Developer uses free webmail (gmail) with no verifiable business identity.
• No CSP on MV3 extension; scripting permission allows page-content injection.
• Extension stale at ~12 months since last update.
• Low install count (1,000) limits blast radius but also limits community vetting.

Evidence

• generic_privacy_policy store Privacy policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• free_webmail_developer store Developer email wallepwa@gmail.com; no business domain; +1.5 Reputation per free-webmail rule.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty → Code Quality 0.0.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• maintenance_stale store months_since_update=12; falls in 6-12mo band → +3.5 Maintenance.
• no_threat_intel_hits api bad_host_hits, affiliate_hits, monetization_hits all empty; no malicious network indicators.
• minimal_permissions manifest Only activeTab, storage, scripting declared; no host_permissions or high-risk permissions.

Permissions Breakdown

• activeTab low Grants access to current tab only on user action; limited scope.
• storage low Local data persistence only; no exfil capability alone.
• scripting medium Can inject scripts into pages; combined with activeTab limits blast radius.

Pillar Scores

Bookkeeping