Top Risks

• Brand impersonation: uses 'Deepseek' name with gmail dev email, not a confirmed owner.
• <all_urls> host permission vastly exceeds stated deepseek.com-only function.
• Privacy policy is Google's own generic policy — scope_extension=false, admits data collection and third-party sharing, not scoped to this extension.
• Developer name 'New ChatGPT Tab for Chrome' mismatches extension name — suspicious identity.
• No CSP + DOM-XSS innerHTML sink in popup.js creates exploitable injection surface.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer is tabchatgpt@gmail.com, not Deepseek; confirmed_owner=false.
• host_permission_overbroad manifest <all_urls> declared but content_scripts scoped only to chat.deepseek.com/*; scripting can target any site.
• generic_privacy_policy api Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — v3.5(D) triggers +10.0.
• developer_identity store Dev name 'New ChatGPT Tab for Chrome' unrelated to product; gmail.com email; free-webmail + no business website.
• dom_xss_sink crx popup.js: innerHTML = content with no CSP present; DOM-XSS risk elevated per v3 FIX B.
• geo_diversity crx JS external hosts span 4 countries (CA,FR,IN,US); category AI not in exemption list; +1.5 network.
• description_mismatch store Promises 'download' functionality but lacks 'downloads' permission; +2.0 webstore.
• no_csp manifest content_security_policy is null; MV3 strict default applies but DOM sink risk still elevated without explicit CSP.

Permissions Breakdown

• activeTab medium Grants access to current tab content on user action; limited scope but paired with scripting raises risk.
• scripting high Allows JS injection into pages; combined with <all_urls> host permission this is broad code execution.
• notifications low Can show desktop notifications; low direct data-exfil risk.
• <all_urls> (host_permission) high Grants scripting access to every site visited, far beyond the stated deepseek.com scope.

Pillar Scores

Bookkeeping