Top Risks

• <all_urls> host access + content scripts despite Meet-only purpose — massive capability overreach
• Privacy policy is generic Google policy, not scoped to extension, admits collection + 3rd-party sharing
• Brand impersonation: uses 'Google' name from free gmail account, unverified publisher
• onInstalled opens 3rd-party extension-best.shop URL — traffic-monetization pattern
• AI transcription processing page content; data egress destinations unverifiable

Evidence

• broad_host_access crx host_permissions and content_scripts include <all_urls> though stated function is Meet-only
• generic_privacy_policy store Policy URL is generic myaccount.google.com policy; scope_extension=false, admits collection+sharing
• brand_impersonation api brand_mention.is_impersonation=true; 'Google' branding from gmail dev, not verified/featured
• install_url_hijack crx onInstalled opens https://google-meet-transcription.extension-best.shop
• free_webmail_dev store Dev email productgmtranscription@gmail.com; no business website, not verified publisher
• stale_maintenance store Last updated 13 months ago
• geo_diverse_hosts api JS hosts resolve across 4 countries (AU, CA, HK, US); includes example.com/test-api.com
• clean_code_scan crx code_findings_raw empty; obfuscation_score 0; no CVEs detected in bundled libs

Permissions Breakdown

• storage low Local state persistence only; standard low-risk API.
• notifications low Notification display; modest abuse surface with host access.
• <all_urls> (host_permissions) high Full read/write on every site; far exceeds stated Meet-only function.
• https://meet.google.com/* (host_permissions) medium Justified for Meet transcription, but grants access to meeting content.
• <all_urls> (content_scripts) high Content scripts injected on all sites; enables page data collection.

Pillar Scores

Bookkeeping