Top Risks

• Uninstall URL hijack to third-party domain
• Use of new Function() constructor across all JS files
• Free webmail developer account (gmail.com)
• Missing Content Security Policy
• Telemetry (Google Analytics) without disclosure in privacy policy

Evidence

• declarativeNetRequestWithHostAccess manifest HIGH permission: network request modification with host access
• scripting manifest MEDIUM permission: arbitrary script injection capability
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() redirects to third-party
• function_constructor crx new Function() detected in all 9 JS files
• free_webmail_dev store Developer uses gmail.com without business website
• no_csp manifest No Content Security Policy defined
• monetization_telemetry crx Google Analytics tracking present
• verified_publisher store Web Store verified publisher badge

Permissions Breakdown

• sidePanel low UI surface only
• alarms low Scheduled tasks, low risk
• storage low Local data persistence
• unlimitedStorage low Expanded quota, minor concern
• offscreen low Background document, limited capability
• scripting medium Arbitrary script injection into pages
• declarativeNetRequestWithHostAccess high Network request blocking/modification with host access

Pillar Scores

Bookkeeping