Top Risks

• Developer uses free Yahoo email with no verifiable business identity — accountability gap.
• Both install and uninstall URL hijack hooks present; targets unresolved, intent unclear.
• Privacy policy URL is the store listing itself — no real data-handling disclosure.
• Operator cluster: 1 sibling extension under same fingerprint may indicate low-quality farm.
• No host permissions or broad content scripts, but stated privacy-tool function is unverifiable.

Evidence

• free_webmail_developer store Developer email benni.es@yahoo.com is a free Yahoo webmail address; no business domain.
• install_url_hijack crx install_url_hijack=true; target is null — hook exists but destination unresolvable.
• uninstall_url_hijack crx uninstall_url_hijack=true; target is null — hook exists but destination unresolvable.
• privacy_policy_points_to_store_listing store privacy_policy_url is the extension's own Web Store page, not a real privacy policy.
• operator_cluster_sibling api sibling_count=1 (jggclakocbglccfomoklndaiihjmlejk) under same dev-email fingerprint.
• is_featured_by_google store Extension carries Featured badge — partial trust signal despite weak dev identity.
• csp_absent_mv3 manifest No explicit CSP declared; MV3 provides default strict CSP so no network penalty applied.
• no_code_findings crx 7 JS files scanned; code_findings_raw empty, obfuscation_score=0.0, no external hosts.

Permissions Breakdown

• storage low Stores local preferences; no cross-origin data access.
• declarativeContent low Reads page URL/title to decide when to act; no content modification.
• declarativeNetRequest medium Can block/redirect network requests; core to stated privacy function.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• jggclakocbglccfomoklndaiihjmlejk

Bookkeeping