Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Slope 2 Unblocked [data-theft] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy admits data collection and 3rd-party sharing without scoping to this extension — worst-case privacy score.
• Uninstall URL hijack: extension redirects users to 3rd-party on removal — strong monetization/tracking indicator.
• Install URL hijack: onInstalled opens 3rd-party URL — game-portal shell monetization pattern confirmed.
• Free-webmail developer (squick542@gmail.com) with no developer name or verified business domain.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; 3rd-party uninstall redirect detected — classic monetization/data-collection shell.
• install_url_hijack crx install_url_hijack=true; onInstalled opens 3rd-party URL — game-portal shell pattern confirmed.
• privacy_policy_scope_fail store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — D clause triggers +10.0.
• free_webmail_dev_no_name store Developer email squick542@gmail.com; developer_name empty; no verified business site.
• external_js_host crx js_external_hosts=[drivemad.net]; game-portal origin, MV3 no-CSP, outbound JS load.
• no_csp_mv3 manifest content_security_policy=null; MV3 strict default applies, no v2 +2.0 Network penalty triggered.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; discounts applied but capped where applicable.
• game_portal_shell crx install+uninstall hijacks + external JS from drivemad.net = game-portal shell pattern; +2.0 Webstore applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Slope 2 Unblocked [data-theft] [divergent] + malext.io malicious_extension_sentry; score 4.19 -> 6.69 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping