Top Risks

• Install and uninstall URL hijack: both redirect to developer-controlled third-party domain on lifecycle events.
• Two innerHTML DOM-XSS sinks (defuddle.min.js, sidepanel.js) with no CSP to mitigate exploitation.
• Free-webmail developer email (gmail.com) with no verified publisher badge; accountability limited.
• Privacy policy admits data collection and third-party sharing but is on dev-controlled domain with retention present.
• 5 external JS hosts (github.com, youtube.com, reddit.com, etc.) for a Markdown viewer—broader than expected reach.

Evidence

• install_url_hijack crx onInstalled opens markdownview.leadingtech.ca/installapp.html — 3rd-party lifecycle tracking.
• uninstall_url_hijack crx setUninstallURL points to markdownview.leadingtech.ca/uninstall.html — monitors uninstall events.
• dom_xss_sink crx innerHTML used in lib/defuddle.min.js and ui/sidepanel.js; no CSP present to block exploitation.
• free_webmail_developer store Developer email mdapp.leadtech@gmail.com; no verified publisher; accountability gap.
• external_js_hosts crx 5 external hosts: github.com, markdownview.leadingtech.ca, reddit.com, www.youtube.com, news.ycombinator.com.
• privacy_policy_third_party_sharing api Policy admits data_collection=true and third_party_sharing=true; scoped but sharing unspecified.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening for innerHTML sinks.
• cve_findings_empty crx No CVEs detected in bundled libraries.

Permissions Breakdown

• activeTab low Access to current tab only on user action; limited scope.
• tabs medium Can read tab URLs and metadata across browser.
• scripting medium Can inject scripts into pages; moderate risk without broad host perms.
• clipboardWrite low Write-only clipboard; lower risk than clipboardRead.
• downloads medium Can trigger file downloads silently.
• storage low Local extension storage; no cross-origin risk.
• sidePanel low UI surface only; no data access.
• contextMenus low Adds right-click menu items; low risk.

Pillar Scores

Bookkeeping