Top Risks

• Brand impersonation: extension names Claude, Deepseek, Gemini but developer is unverified gptsidebar.com.
• Content scripts injected on <all_urls> + mail.google.com — reads all page content including emails.
• Uninstall and install URL hijacks redirect users to third-party pages.
• Privacy policy discloses third-party data sharing with no retention period specified.
• CSP allows connect-src to cdn.jsdelivr.net and lumerexa.com (unknown third party).

Evidence

• brand_impersonation store Title references Claude, Deepseek, Gemini — developer not verified as any of these orgs.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; install_url_hijack to https://gptsidebar.com/welcome.
• content_scripts_broad manifest Content scripts match <all_urls> + mail.google.com — reads all page content.
• no_developer_name store developer_name field is empty; reduces accountability.
• third_party_data_sharing api Privacy policy: third_party_sharing=true, retention=false — inadequate data governance.
• external_host_lumerexa crx lumerexa.com in js_external_hosts and CSP connect-src; unrecognized third party.
• geo_diversity crx JS hosts span 4 countries (AU, CA, TR, US) — elevated exfil surface for AI extension.
• function_constructor crx new Function() in tesseract/worker.min.js — code-quality concern for dynamic execution.

Permissions Breakdown

• sidePanel low UI panel only; low standalone risk.
• <all_urls> (host_permissions) high Grants content-script and fetch access to every site the user visits.
• content_scripts <all_urls> high JS injected into every page — reads/modifies all page content including credentials.

Pillar Scores

Bookkeeping