Top Risks

• Zoom brand impersonation: not confirmed owner, extension titled 'Zoom Block' trading on Zoom name.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer domain wesleywarnell.com does not resolve, raising accountability concerns.
• Extension is 22 months stale (last updated Aug 2024), no active maintenance signals.
• No CSP declared (MV3 mitigates somewhat, but combined with stale state and brand mention adds risk).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[zoom], confirmed_owner=false.
• privacy_policy_generic store Policy URL is Google myaccount policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_domain_not_resolving api wesleywarnell.com resolves=false; developer accountability cannot be verified.
• maintenance_stale store Last updated August 11, 2024; months_since_update=22, approaching 24mo stale band.
• no_csp manifest content_security_policy is null; MV3 strict default partially mitigates but no explicit policy declared.
• featured_by_google store is_featured_by_google=true; partial trust signal, but does not override impersonation or policy concerns.
• low_permissions manifest Only 'storage' declared; no host permissions, no content_scripts; minimal capability surface.
• install_count_10k store 10,000 installs with a Zoom brand name and non-resolving dev domain increases blast radius concern.

Permissions Breakdown

• storage low Stores per-tab zoom preferences locally; low risk, matches stated function.

Pillar Scores

Bookkeeping