Top Risks

• HIGH permissions (privacy, tabCapture, declarativeNetRequestWithHostAccess) with <all_urls> host access
• No Content Security Policy with DOM-XSS sink detected in popup.bundle.js
• Free webmail developer (gmail.com) with no verified publisher status
• 18 months since last update indicates potential abandonment
• Small install base (1,000) with high-tier permissions creates tail attack surface

Evidence

• permissions manifest tabCapture, privacy, declarativeNetRequestWithHostAccess, <all_urls>
• no_csp crx content_security_policy is null with dom_sink_innerhtml_userctrl finding
• developer_identity store Free gmail developer, not verified, no business website
• staleness store 18 months since update, install_perm_anomaly.tail_attack_surface=true
• dom_xss_sink crx innerHTML assignment from variable in popup.bundle.js (React 16.13.1)
• privacy_policy api Scoped policy found but retention not disclosed, third_party_silence=true

Permissions Breakdown

• tabCapture high Can capture tab content including audio/video streams
• privacy high Can modify browser privacy settings
• webNavigation medium Can monitor navigation events across all sites
• scripting medium Can inject scripts into web pages
• downloads medium Can download files to user's system
• declarativeNetRequestWithHostAccess high Can intercept and modify network requests on all URLs
• offscreen low Can run code in offscreen documents
• storage low Local storage access
• contextMenus low Can add context menu items
• <all_urls> high Broad host access to all websites

Pillar Scores

Bookkeeping