Top Risks

• Broad <all_urls> access with scripting on every site
• Privacy policy admits data collection & 3rd-party sharing without scoping to this extension
• Free webmail developer with no verified publisher identity
• External network calls to getsnip.cc and google-analytics.com

Evidence

• Broad host + scripting manifest <all_urls> and *://*/* content scripts with scripting permission.
• Free webmail dev store Developer email is goodmoviesinfo@gmail.com; no verified publisher.
• Admits collection & sharing api Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true.
• External hosts manifest js_external_hosts: getsnip.cc, www.google-analytics.com
• Featured badge cap store is_featured_by_google true but broad HIGH capability; discount capped at -1.0.
• No CSP (MV3) manifest csp_present=false; MV3 applies strict defaults but no custom policy.
• Stale extension store Last updated >7 months ago; moderate maintenance risk.
• No code findings crx code_findings_raw empty, obfuscation_score=0.0, 6 JS files scanned.

Permissions Breakdown

• scripting medium Can inject/execute scripts on pages; medium risk requiring host access.
• storage low Local storage for extension state; minimal risk.
• <all_urls> high Broad host access to all sites; high reach and impact.
• *://*/* (content_scripts) high Content scripts run on all URLs; broad execution surface.

Pillar Scores

Bookkeeping