Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pie Adblock - A Powerful Free Ad Blocker + malext.io malicious_extension_sentry (+2.5, capped).
• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• eval() of variable in twitch userscript + management permission creates elevated code-exec risk.
• management permission allows enumeration and control of other installed extensions.
• Privacy policy discloses third-party data sharing; no isolation to extension context concerns.

Evidence

• verified_publisher + featured store Verified publisher badge and featured by Google; reputation floor applied at 2.0.
• eval_user_input crx eval(workerString) in twitch-vaft-userscript-v2.js — dynamic eval of variable.
• function_constructor x3 crx new Function('return this') pattern in 3 content scripts; low-severity globalThis polyfill pattern.
• management permission manifest management permission declared; can enumerate/disable other extensions — high risk not fully justified by adblock.
• privacy_policy third_party_sharing api Policy fetched, scoped, data_collection+third_party_sharing=true, retention=true. +1.0 for sharing.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target URL not captured for verification.
• js_external_hosts x11 crx 11 distinct external hosts including retail (amazon, asos, acehardware) and twitch.tv — expected for affiliate adblock.
• cve_findings_raw empty crx No CVEs detected in bundled libraries (jquery 3.7.1, react 16.13.1). CVE pillar = 0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pie Adblock - A Powerful Free Ad Blocker + malext.io malicious_extension_sentry; score 3.92 -> 6.42 (+2.5 cap 2.5).

Permissions Breakdown

• alarms low Scheduling only; minimal risk.
• cookies high Access to all cookies; paired with <all_urls> amplifies risk, but justified for adblock.
• tabs medium Can read tab URLs and metadata.
• storage low Local extension data only.
• scripting high Arbitrary script injection into pages; core to adblock function.
• webNavigation medium Monitors navigation events across all tabs.
• unlimitedStorage low Storage quota only; no data access risk.
• declarativeNetRequestWithHostAccess high Intercept/block network requests broadly; expected for adblock.
• declarativeNetRequestFeedback low Read-only feedback on matched rules.
• webRequest high Observe all network requests; core adblock capability.
• management high Can enumerate/manage other extensions; elevated risk.
• offscreen low Off-screen document; limited risk surface.
• <all_urls> (host) high Broad host access enabling script/request interception on every site.

Pillar Scores

Bookkeeping