Top Risks

• Gmail dev email + uninstall/install URL hijack hooks signal monetization or tracking intent on low-install AI extension.
• Privacy policy is Google's own generic policy — completely unscoped to this extension; scores maximum privacy risk.
• Contacts backend.extrapidsoftware.cc and thumbmarkjs.com (fingerprinting API) — browser fingerprinting with <all_urls> reach.
• scripting + <all_urls> + content_scripts on all URLs gives full DOM read/write capability across every site visited.
• small_install_high_perm anomaly: 655 installs with HIGH-tier permissions and no CSP is a tail-attack-surface indicator.

Evidence

• free_webmail_dev_no_business store extrapidsoftware@gmail.com — gmail dev, no verified publisher, no business domain.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() hook present; uninstall_url_hijack=true.
• install_url_hijack crx onInstalled opens 3rd-party URL; install_url_hijack=true.
• fingerprinting_host crx api.thumbmarkjs.com in js_external_hosts — known browser fingerprinting service.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external JS hosts.
• dom_xss_sink crx innerHTML from variable in chunk-db194802.js; no CSP and no eval finding but XSS sink present.
• small_install_high_perm api 655 installs with scripting+<all_urls>+tabs+identity flagged by install_perm_anomaly.

Permissions Breakdown

• scripting high Allows JS injection into any page via <all_urls> host_permissions — full page control.
• storage low Local key-value storage; low standalone risk.
• sidePanel low Opens side panel UI; limited risk.
• contextMenus low Adds right-click menu items; low risk.
• activeTab medium Grants temporary access to focused tab; medium risk in combination.
• tabs medium Can read URLs, titles of all open tabs.
• offscreen medium Allows hidden document execution; can be used for covert processing.
• identity medium Can access OAuth tokens; risk if misused to access user accounts.
• <all_urls> high Full host access across every site user visits; highest reach permission.

Pillar Scores

Bookkeeping