Top Risks

• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection + 3rd-party sharing) — worst-case privacy score.
• Uninstall URL hijack redirects to forms.gle and install URL opens tilda.ws — monetization/tracking shell pattern.
• <all_urls> host permission with content_scripts on all sites gives full page-content read capability for a simple word counter.
• Developer uses free Gmail address with no verified business identity; featured badge does not compensate for unaccountable developer.
• 5 external JS hosts (tilda.ws, svelte.dev, tailwindcss.com, docs.google.com, forms.gle) with no CSP and MV3 but no content_security_policy declared.

Evidence

• install_url_hijack crx onInstalled opens https://chrome-extensions.tilda.ws/word-counter — third-party redirect on install.
• uninstall_url_hijack crx setUninstallURL points to https://forms.gle/mUsgHKZ53ibr2ims6 — data harvesting on uninstall.
• privacy_policy_generic store Policy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• host_permissions_all_urls manifest <all_urls> host permission + content_scripts on all sites — high capability for a word counter.
• free_webmail_developer store Developer email word.counter.extension@gmail.com; no verified business domain.
• js_external_hosts crx 5 external hosts: chrome-extensions.tilda.ws, docs.google.com, forms.gle, svelte.dev, tailwindcss.com.
• no_csp manifest content_security_policy is null; no CSP declared despite external host references.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; 5000 installs with HIGH-tier host permission.

Permissions Breakdown

• storage low Stores local extension settings; minimal risk.
• sidePanel low Displays a side panel UI; no data exfil risk alone.
• <all_urls> (host_permissions) high Content scripts injected on every site; broad read access to all page content.

Pillar Scores

Bookkeeping