Top Risks

• Brand impersonation: claims Discord affiliation but developer is unrelated gmail user with no confirmed ownership.
• Broad host_permissions (https://*/*) far exceeds stated function scope of discord.com only.
• Free-webmail developer (exportmyinfohq@gmail.com), no developer name, no verified business identity.
• Privacy policy on ext-boost.com admits data collection and third-party sharing without retention disclosure.
• Description promises 'download' but extension lacks the 'downloads' permission — permission/promise mismatch.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; Discord brand used, developer domain is gmail.com, confirmed_owner=false.
• broad_host_permissions manifest host_permissions=['https://*/*'] but content_scripts scoped only to discord.com — scope mismatch.
• free_webmail_no_devname store developer_email=exportmyinfohq@gmail.com, developer_name empty, no verified business website.
• privacy_policy_third_party_sharing api Policy fetched from ext-boost.com: data_collection=true, third_party_sharing=true, retention=false.
• description_permission_mismatch store Promises download capability but 'downloads' permission absent from manifest.
• dom_xss_sink crx innerHTML assigned from variable in popup.100f6462.js with no CSP present — DOM-XSS risk.
• external_js_host_api_ext_api_com crx JS contacts api.ext-api.com (same domain as privacy policy host ext-boost.com ecosystem).
• small_install_high_perm api 161 installs with HIGH-tier host permission (https://*/*) — tail attack surface anomaly.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• identity medium OAuth token access; could expose Google identity to extension.
• identity.email medium Explicitly requests user email via OAuth — unnecessary for a chat downloader.
• tabs medium Can read tab URLs and titles across browsing session.
• https://*/* high Broad host access across all HTTPS sites, far exceeding discord.com scope.

Pillar Scores

Bookkeeping