Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, yet admits data collection and third-party sharing.
• Free-webmail developer (jjkapp2020@gmail.com) with no dev name or verifiable business; no domain accountability.
• No last_updated date available; maintenance status unknown — could be long-abandoned MV3 shell.
• Two innerHTML DOM-XSS sinks in JS with no CSP; user-controlled data could be injected into extension UI.
• Text is submitted to external spell-check services (languagetool.org, nara-speller.co.kr); user input leaves the browser.

Evidence

• free_webmail_dev_no_name store Developer email jjkapp2020@gmail.com; developer_name empty; no business domain — Reputation floor hit.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp manifest content_security_policy is null (MV3 default CSP applies but no explicit extension-page CSP hardening).
• dom_xss_sink crx innerHTML assigned from variable in js/option.js and js/spellcheck.js with no CSP — DOM-XSS risk.
• external_text_submission manifest Host permissions cover languagetool.org, nara-speller.co.kr; user text sent to external APIs.
• maintenance_unknown store last_updated is empty string; months_since_update is null — cannot confirm recency; defaulting to 6-12mo band.
• verified_publisher store verified_publisher=true partially offsets reputation risk; capped per 0c due to null months_since_update.
• 100k_installs_moderate_rating store 100,000 installs at 3.5 rating — significant blast radius; rating below 4.5 threshold for trust discount.

Permissions Breakdown

• storage low Local data persistence; low direct harm.
• tabs medium Can read tab URLs and titles across all open tabs.
• contextMenus low Adds right-click menu entries; limited risk.
• system.display low Reads display configuration; unusual for a spell checker but low harm.
• host:*://*.googleapis.com/* medium Allows requests to Google APIs; needed for spell-check backend.
• host:*://languagetool.org/* medium Spell-check API; text may be sent externally.
• host:*://*.languagetool.org/* medium Same as above; subdomains covered.
• host:*://*.nara-speller.co.kr/* medium Korean spell-check service; external text submission.

Pillar Scores

Bookkeeping