Top Risks

• nativeMessaging with unrecognized publisher: extension can bridge to OS-level native app with no publisher sanity check.
• cookies + scripting + <all_urls> + webRequest: full read/write/intercept of all sites and sessions.
• Privacy policy not scoped to extension; fetched policy admits data collection and third-party sharing (+10 privacy).
• No CSP (MV3 strict default applies but csp_present=false noted); new Function() in background.js raises code-quality concern.
• AI category processing page content at scale; 7M installs amplifies blast radius of any compromise or policy change.

Evidence

• nativeMessaging + publisher_recognized=false crx Extension uses nativeMessaging but native_messaging_check.publisher_recognized is false; adds +3.0 permissions.
• cookies + <all_urls> manifest HIGH permission cookies paired with broad host access triggers x1.2 amplifier on permissions pillar.
• privacy_policy scope_extension=false, data_collection=true, third_party_sharing=true api Policy fetched but not scoped to this extension, admits data collection and third-party sharing → Privacy pillar +10.0.
• uninstall_url_hijack=true crx chrome.runtime.setUninstallURL() redirects user on uninstall; adds +3.0 webstore signal.
• function_constructor in background.js crx new Function() in background script is a code-quality risk signal (+2.5 code quality).
• is_featured_by_google=true, rating=4.5 store Google Featured badge and high rating provide partial trust signal; reputation floor applied.
• looks_throwaway=true on wps.com api developer_domain_info.looks_throwaway=true despite wps.com resolving; adds +1.5 webstore.
• AI extension processing page content at 7M installs store +2.5 webstore for AI/Gen-AI category processing page content; +1.0 installs>1M; -0.5 popularity-trust.

Permissions Breakdown

• webRequest high Intercept/observe all network requests; paired with <all_urls> is maximum-reach.
• webNavigation medium Observe all page navigations across every site visited.
• storage low Local extension data storage; standard low-risk capability.
• tabs medium Read URL, title, and status of all open tabs.
• nativeMessaging high Communicate with host-OS native app; publisher_recognized==false amplifies risk.
• declarativeNetRequest medium Modify/block network requests; lower risk than webRequestBlocking alone.
• gcm medium Receive push messages from developer servers silently.
• cookies high Read/write cookies on all URLs; combined with <all_urls> = critical surface.
• notifications low Display desktop notifications; limited direct data-access risk.
• scripting high Inject arbitrary JS into any page; paired with <all_urls> is very high risk.
• <all_urls> (host_permissions) high Broad host access amplifies every HIGH permission by x1.2 multiplier.

Pillar Scores

Bookkeeping