Top Risks

• Gmail developer with no dev name; free-webmail identity raises accountability concerns.
• webRequest + broad host_permissions (http/https all URLs) enables full request interception.
• eval() of a variable in pdf.sandbox.js is a high-risk code pattern even in a PDF engine context.
• No CSP present (MV3 so no +2 network penalty, but eval findings amplify code risk).
• Privacy policy lacks retention disclosure and is silent on third-party sharing.

Evidence

• developer_email_free_webmail store jgarrettk13@gmail.com — free-webmail, no business domain, developer_name empty.
• verified_publisher_and_featured store verified_publisher=true AND is_featured_by_google=true; applies reputation discount.
• broad_host_permissions manifest host_permissions include https://* and http://* — all sites covered.
• eval_user_input crx pdf.sandbox.js: globalThis.eval(code) on a variable — direct eval risk.
• function_constructor crx pdf.js and pdf.worker.js use new Function() — typical in PDF.js but still raises code quality score.
• no_csp manifest content_security_policy is null; no mitigating CSP for eval findings.
• privacy_policy_retention_missing api Privacy policy fetched; scope_extension=true, data_collection=true, retention=false, third_party_silence=true.
• js_external_hosts crx Contacts chrome.google.com, mozilla.github.io, www.apache.org — all reputable open-source hosts.

Permissions Breakdown

• webRequest high Can intercept and observe all HTTP/S requests across all URLs — high surveillance capability.
• webNavigation medium Monitors browser navigation events; useful for PDF detection but exposes browsing patterns.
• storage low Stores extension settings locally; low standalone risk.
• contextMenus low Adds right-click menu entries; minimal risk.
• https://*/ high Broad host access to all HTTPS sites; combined with webRequest creates wide surveillance surface.
• http://*/ high Broad host access to all HTTP sites; same concern as https.

Pillar Scores

Bookkeeping