Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing.
• Brand impersonation: extension name/function centers on 'Telegram' brand; developer not affiliated.
• Developer email on qq.com flagged as throwaway-like; no verifiable business identity.
• Description promises download functionality but lacks 'downloads' permission — possible mismatch/shell indicator.
• No CSP on MV3 extension with new Function() constructor in content scripts injected into Telegram Web.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[telegram]; confirmed_owner=false.
• generic_privacy_policy store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store Dev email limiaolichuang@qq.com; domain looks_throwaway=true per threat_intel.
• function_constructor crx new Function() in teleram-contentScript.js and teleram-iniectJs.js; injected into web.telegram.org.
• description_permission_mismatch store description_promise: promises download but lacks 'downloads' permission.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit hardening.
• maintenance_stale store months_since_update=17; falls in 12-24mo band (+6.0 maintenance).
• featured_by_google store is_featured_by_google=true; provides partial reputation offset despite unverified publisher.

Permissions Breakdown

• storage low Local key-value storage only; no cross-site data access.
• host_permission: https://web.telegram.org/* medium Scoped to Telegram Web only; content scripts injected here can read all page content.

Pillar Scores

Bookkeeping