Top Risks

• Privacy policy is a generic Zoom corporate policy, not scoped to this extension; admits data collection and third-party sharing.
• install_url_hijack flag set true; onInstalled may open a third-party URL.
• CSP script-src allows broad https://*.google.com and https://*.zoom.us remote origins.
• Operator cluster has 1 sibling extension under same fingerprint; adds marginal blast-radius concern.
• Rating 3.9 across large install base; no review red flags detected but below 4.0 threshold.

Evidence

• privacy_policy_not_extension_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → privacy pillar 10.0.
• install_url_hijack crx install_url_hijack=true, target=null; onInstalled opens external URL. Webstore +2.0.
• is_featured_by_google store Google Featured badge present; reputation discount -2.0 applied.
• confirmed_owner_brand store brand_mention.confirmed_owner=true, developer_domain=zoom.us resolves; no impersonation.
• csp_remote_script_src crx script-src includes https://*.google.com and https://*.zoom.us; not unsafe-eval/inline.
• operator_cluster_sibling api sibling_count=1 (pnlbnejodfpnapdpoiboebofddaejkbg); Webstore +2.5.
• no_cve_findings crx cve_findings_raw empty; jquery 3.7.1 bundled, no known CVEs.
• recently_updated store months_since_update=1; maintenance pillar 0.0.

Permissions Breakdown

• storage low Persists meeting preferences locally; minimal risk.
• unlimitedStorage low Allows larger local storage quota; no remote exfil risk alone.
• host:https://www.google.com/calendar/* medium Content script on Google Calendar to inject Zoom scheduling UI; matches stated function.
• host:https://calendar.google.com/calendar/* medium Content script on Google Calendar; same justified-broad discount applies.
• host:https://*.zoom.us/* low First-party Zoom domain access; necessary for auth and meeting launch.
• host:https://*.zoom.com/* low First-party Zoom domain access; consistent with stated function.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• pnlbnejodfpnapdpoiboebofddaejkbg

Scoring History

Bookkeeping