Top Risks

• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer uses free Yahoo webmail with no identifiable business, raising accountability concerns.
• install_url_hijack and uninstall_url_hijack both flagged true — extension opens or redirects on install/uninstall.
• Operator cluster has 1 sibling extension under same Yahoo email fingerprint.
• No CSP declared (MV3 mitigates somewhat but increases code-quality surface uncertainty).

Evidence

• install_url_hijack crx install_url_hijack=true; target null but flag is set — onInstalled likely opens a 3rd-party URL.
• uninstall_url_hijack crx uninstall_url_hijack=true; monetization/tracking redirect pattern on uninstall.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• free_webmail_developer store Developer email benni.es@yahoo.com is free webmail; no business domain or verified publisher.
• operator_cluster api Sibling extension jijiojkjpehlogccmnkokddfoniihnjm shares same dev-email fingerprint.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• no_csp manifest content_security_policy is null; MV3 provides defaults but no explicit hardening.
• low_rating store Rating 3.3 may indicate user dissatisfaction; rating_count not disclosed.

Permissions Breakdown

• storage low Stores extension state locally; low direct harm.
• activeTab medium Grants temporary access to current tab on user action; limited scope.
• scripting medium Can inject scripts into pages; risk contained by activeTab scope.
• contextMenus low Adds right-click menu items; low standalone risk.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• jijiojkjpehlogccmnkokddfoniihnjm

Bookkeeping