Top Risks

• Extension abandoned 50 months ago — high risk of unpatched vulnerabilities or silent compromise.
• scripting + <all_urls> gives capability to read/modify every page with no host restriction.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no business website — no accountability if extension is sold or abused.
• new Function() in bundled emscripten wasm loader; no CSP to block dynamic code execution.

Evidence

• broad_host_access manifest host_permissions includes <all_urls> paired with 'scripting' — can inject JS on every site.
• maintenance_stale store Last updated June 2022; 50 months since update — well beyond 36-month max-stale threshold.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email moonrailgun@gmail.com; no business domain, no verified publisher badge.
• function_constructor crx new Function() found in two emscripten wasm loader files; no CSP present to restrict dynamic code.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit lockdown declared.
• small_install_high_perm api 176 installs with <all_urls>+scripting; tail-attack-surface anomaly flagged.
• external_js_host crx js_external_hosts includes emscripten.org; third-party JS origin referenced from extension.

Permissions Breakdown

• scripting high Allows arbitrary JS injection into pages; combined with <all_urls> covers every site.
• <all_urls> (host_permission) high Broad host access enabling scripting to run on every URL the user visits.

Pillar Scores

Bookkeeping