Top Risks

• Content scripts injected on <all_urls> for an emulator — massive scope mismatch with stated purpose.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified identity or business presence.
• declarativeNetRequest + <all_urls> gives capability to redirect/block any user request.
• new Function() constructor in both background and content scripts signals dynamic code execution capability.

Evidence

• host_permissions_all_urls manifest <all_urls> host permission + content_scripts on <all_urls> for an NES emulator is a severe scope mismatch.
• privacy_policy_generic store Policy is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Free gmail dev (hunkiepeanut.dev@gmail.com), no verified publisher, no business domain.
• function_constructor crx new Function() found in both background.js and content_script.js — dynamic code execution risk.
• external_cdn crx js_external_hosts includes unpkg.com — CDN dependency introduces supply-chain risk.
• install_perm_anomaly api Only 396 installs but has HIGH-tier permissions (small_install_high_perm=true).
• declarativeNetRequest_scope_mismatch manifest declarativeNetRequest declared by an emulator extension with no adblock or security stated purpose.
• rating_low store Rating 2.8 — below average, though rating_count not available to confirm threshold.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; medium risk alone but elevated with <all_urls>.
• storage low Local data persistence; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; concerning for an emulator.
• <all_urls> (host_permissions) high Full cross-origin host access; content scripts injected into every page.
• <all_urls> (content_scripts_matches) high JS injected into every page the user visits; broad reach for an emulator.

Pillar Scores

Bookkeeping