Top Risks

• Extension abandoned since Sep 2022 (~31 months); no updates in 2+ years.
• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and third-party sharing.
• Developer is unverifiable gmail user (bhnmzm@gmail.com) with no business identity; brand impersonation of Netflix.
• innerHTML DOM sink in content script on Netflix pages with no CSP — XSS risk if subtitle content is attacker-controlled.
• Free-webmail developer with no verified publisher status and no developer name raises supply-chain/abandonment risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, confirmed_owner=false, developer_domain=gmail.com — Netflix brand used without authorization.
• free_webmail_developer manifest developer_email=bhnmzm@gmail.com; no business website, no verified publisher, no developer name.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.
• stale_extension store Last updated Sep 15 2022; ~31 months ago. No updates since MV3 launch era.
• dom_xss_sink_no_csp crx innerHTML assigned from variable in content/index.js with csp_present=false. DOM-XSS risk on Netflix pages.
• no_csp manifest content_security_policy=null on MV3 extension; no explicit CSP hardening.
• reputation_signals store Not verified publisher, not featured, free webmail, no developer name. Reputation floor triggers at 7.5.
• cve_findings_clean crx cve_findings_raw=[]; no known CVEs in bundled libraries.

Permissions Breakdown

• tabs medium Can read tab URLs/titles; medium-tier permission.
• activeTab low Scoped to user-activated tab only; limited surface.
• storage low Local data persistence; no exfil path alone.
• https://netflix.com/* low Host permission scoped to Netflix only; matches stated function.
• https://www.netflix.com/* low Host permission scoped to Netflix only; matches stated function.

Pillar Scores

Bookkeeping