Top Risks

• Privacy policy is Google's generic policy — no scope to this extension, admits data collection and third-party sharing (D rule: +10.0).
• Brand impersonation: extension uses 'eBay' branding but developer is unverified gmail user (webgurudev@gmail.com).
• DOM-XSS sink: innerHTML assigned from externally-sourced variable in ebayprice.js with no CSP.
• Free-webmail developer with no business domain; reputation floor applies (gmail + no verified publisher).
• No CSP present on MV3 extension with DOM-sink finding; amplifies XSS risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brand=ebay, developer is gmail user with no verified publisher status.
• privacy_policy_generic store Policy is Google's myaccount page: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 (rule D).
• dom_xss_sink crx ebayprice.js: innerHTML assigned from variable containing sold_link; no CSP to mitigate.
• no_csp manifest content_security_policy is null; MV3 strict default applies but dom-sink finding is elevated without explicit CSP.
• free_webmail_developer store developer_email=webgurudev@gmail.com; no business website; reputation floor >= 7.5 triggered.
• low_rating store Rating 3.1; insufficient rating_count data to apply +1.0 penalty but below-average trust signal.
• content_scripts_scope manifest Content scripts injected into 6 eBay TLD variants; scoped to stated function, medium risk.
• maintenance store months_since_update=11; falls in 6-12mo band (+3.5).

Permissions Breakdown

• content_scripts (*://*.ebay.ca/*, *://*.ebay.com/*, etc.) medium Injects JS into all eBay domains; scoped to stated function but enables DOM read/write.

Pillar Scores

Bookkeeping