Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — RFC Instant Finder - México [credential-theft] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension, data_collection=true, third_party_sharing=true.
• Developer email is free-webmail (gmail) with no developer name and no business website, raising identity accountability concerns.
• Extension loads JS from external host ceduladeidentificacionfiscal.com.mx with no CSP, enabling future remote-code injection.
• verified_publisher flag present but dev identity (no name, gmail-only) limits trust benefit under v3.5 invariant 0c.

Evidence

• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → privacy pillar max.
• free_webmail_dev_no_name store developer_email=azharabbasabc62@gmail.com, developer_name empty, no business domain verified.
• external_js_host crx js_external_hosts=['ceduladeidentificacionfiscal.com.mx']; no CSP (csp_present=false); MV3 mitigates but host unverified.
• verified_publisher_claimed store verified_publisher=true but capped to -1.0 discount under v3.5 (monetization_hits empty but gmail identity reduces trust).
• minimal_permissions manifest Only 'storage' declared; no host_permissions, no content_scripts_matches — very narrow capability surface.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0, js_files_scanned=2 — no malicious code signals detected.
• no_cve_findings crx cve_findings_raw=[] and js_libraries_detected=[] — no vulnerable bundled libraries.
• low_installs store installs=7; blast radius negligible, but also means no community vetting or behavioural history.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — RFC Instant Finder - México [credential-theft] [divergent] + malext.io malicious_extension_sentry; score 3.15 -> 5.65 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local key-value storage only; cannot exfiltrate data on its own.

Pillar Scores

Bookkeeping