Top Risks

• Brand impersonation: extension targets PayPal but developer domain is unrelated kleinanzeigen-enhanced.de; confirmed_owner=false.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — not scoped to this extension at all.
• No CSP declared (MV3 default only); content script runs on PayPal financial billing pages with no additional sandboxing.
• Developer identity mismatch: domain serves a different product (classifieds enhancer) yet publishes a PayPal finance tool.
• Very low install count (166) with impersonation signal raises tail-attack-surface concern.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'paypal'; developer_domain=kleinanzeigen-enhanced.de; confirmed_owner=false.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true per classifier.
• no_csp manifest content_security_policy=null; csp_present=false. MV3 default applies but no explicit hardening.
• content_script_financial manifest content_scripts_matches=['https://*.paypal.com/billing/*'] — injects into PayPal billing pages.
• developer_domain_mismatch store Developer domain 'kleinanzeigen-enhanced.de' is a German classifieds enhancer, unrelated to PayPal subscriptions.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[]. Single JS file scanned.
• maintenance_ok store months_since_update=4; within 3-6mo band. Low staleness risk.
• threat_intel_clean api bad_host_hits=[], affiliate_hits=[], monetization_hits=[]; developer_domain resolves, not throwaway.

Permissions Breakdown

• content_scripts:https://*.paypal.com/billing/* medium Runs JS on PayPal billing pages; scoped narrowly but accesses financial UI context.

Pillar Scores

Bookkeeping