Top Risks

• proxy + webRequest + <all_urls>: full traffic interception capability with no CSP constraint
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing
• Developer uses free Gmail address (salarcode@gmail.com) with no verified business identity
• No CSP on MV3 extension that loads external JS hosts (datatables.net, popper.js.org)
• webRequestAuthProvider can supply proxy credentials — risk of credential harvesting if extension is compromised

Evidence

• proxy+webRequest+all_urls combo manifest proxy, webRequest, webRequestAuthProvider declared with <all_urls>; enables full traffic interception.
• generic privacy policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free-webmail developer store developer_email=salarcode@gmail.com; no verified business domain or publisher badge.
• no CSP crx content_security_policy is null; external JS hosts referenced: datatables.net, popper.js.org.
• no code findings crx code_findings_raw empty, obfuscation_score=0.0, 13 JS files scanned — clean scan.
• no CVEs crx cve_findings_raw empty; @popperjs/core version unknown but no CVE matched.
• no bad/monetization/affiliate hits api threat_intel shows no bad_host_hits, monetization_hits, or affiliate_hits.
• recently updated store last_updated May 19, 2026; months_since_update=1 — actively maintained.

Permissions Breakdown

• activeTab low Access to currently active tab only; limited scope.
• tabs medium Can read tab URLs and titles across browser session.
• proxy high Can redirect all browser traffic through arbitrary proxy servers.
• webRequest high Observe and intercept all network requests across all URLs.
• webRequestAuthProvider high Supply credentials for proxy auth challenges — credential interception risk.
• storage low Standard local config persistence.
• unlimitedStorage low Allows large local data storage; low direct risk.
• notifications low Display desktop notifications; minimal risk.
• <all_urls> high Broad host access; combined with proxy/webRequest enables full traffic interception.

Pillar Scores

Bookkeeping