Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Broad host access (<all_urls> + content_scripts on all URLs) with scripting permission enables full page read/write on every site.
• Developer uses free Gmail account with no verifiable business identity or domain.
• clipboardRead permission allows reading any clipboard content; combined with 12 external AI/translation API hosts, creates data-exfil surface.
• 12 external JS hosts including OpenAI, DeepSeek, DeepL, OpenRouter — high reach for an individual Gmail developer.

Evidence

• privacy_policy_generic store Privacy URL is Google's generic account policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy classification.
• free_webmail_developer store Developer email m.khani2810@gmail.com; no business domain; no verified publisher badge.
• broad_host_access manifest <all_urls> host permission + content_scripts on *://*/* and file:///* with scripting permission.
• external_hosts_count crx 12 external hosts contacted: openai.com, deepl, deepseek, openrouter.ai, github.com, bing.com, googleapis, etc.
• function_constructor crx new Function() in assets/ocr/worker.min.js; context appears to be globalThis polyfill, low exploitability.
• no_bad_hosts api threat_intel shows no bad_host_hits, no affiliate_hits, no monetization_hits.
• csp_present_mv3 manifest CSP restricts script-src to self+wasm-unsafe-eval; MV3 enforced; no remote script loading in CSP.
• no_cve_findings crx cve_findings_raw is empty; no known vulnerable bundled libraries detected.

Permissions Breakdown

• storage low Stores user preferences locally.
• scripting high Can inject scripts into any page via <all_urls> host access.
• tabs medium Can read tab URLs and metadata across all tabs.
• webNavigation medium Observes navigation events across all pages.
• clipboardWrite medium Can write translated content to clipboard.
• clipboardRead medium Can read clipboard contents; potential data exfil vector.
• notifications low Shows desktop notifications.
• offscreen low Off-screen document for background processing.
• contextMenus low Adds right-click menu items for translation.
• sidePanel low Opens side panel UI.
• <all_urls> high Broad host access enabling content injection and data access on all sites.
• file://*/* medium Access to local files on disk; uncommon for translation tools.

Pillar Scores

Bookkeeping