Top Risks

• No last_updated date available — maintenance posture completely unknown, worst-case applied.
• Privacy policy is Google's generic account policy; not scoped to this extension, admits data collection and 3rd-party sharing.
• Developer uses free Gmail address with no verifiable business identity.
• Content script injected on <all_urls> despite simple stated function — broad page reach unjustified.
• No CSP present on MV3 extension; combined with broad content-script injection increases DOM-manipulation risk.

Evidence

• content_scripts_matches=<all_urls> manifest Content script runs on every URL; over-broad for a tab-focus utility.
• privacy_policy_generic store Policy URL is myaccount.google.com — Google's own account policy, not scoped to Tab Activate.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 (D).
• developer_email_free_webmail store tabactivate@gmail.com; developer_name same as extension title; no verified business entity.
• months_since_update=null store last_updated empty; maintenance pillar scored at maximum (10.0) per missing-data conservative rule.
• no_csp manifest content_security_policy is null; MV3 default provides some protection but no explicit hardening.
• install_count=50000 store 50k installs raises blast radius; all users have content script running on every page.
• code_findings_clean crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts — code surface appears minimal.

Permissions Breakdown

• tabs medium Grants access to tab metadata (URLs, titles); needed for tab management but can expose browsing context.
• content_scripts:<all_urls> high Content script injected into every page; broad reach even without explicit host_permissions declared.

Pillar Scores

Bookkeeping