Top Risks

• Content script runs on <all_urls>; can read/mutate every page the user visits.
• No CSP declared; innerHTML sinks in popup.js and settings.js create DOM-XSS surface.
• Developer email is free-webmail (gmail) with no developer_name listed.
• External JS hosts include reactjs.org (third-party CDN) alongside own CDN.
• Privacy policy admits data collection and third-party sharing without retention disclosure.

Evidence

• content_scripts_matches=<all_urls> manifest Content scripts injected into every URL; broad reach despite no host_permissions declared.
• no_csp manifest csp_present=false on MV3 extension; amplifies DOM-XSS risk from innerHTML findings.
• dom_sink_innerhtml_userctrl x2 crx innerHTML assigned from variable in popup.js and settings.js; no CSP mitigates.
• free_webmail_dev store cutecursor@gmail.com; no developer_name; domain_age_ct not queried (free webmail).
• external_cdn_reactjs.org crx js_external_hosts includes reactjs.org — third-party domain outside dev control.
• privacy_no_retention api Policy fetched, scoped, admits data collection + third-party sharing but retention=false.
• verified_publisher+featured store Verified publisher and featured badges present; apply discounts to reputation pillar.
• no_bad_hosts_no_cve api bad_host_hits=[], cve_findings_raw=[], monetization_hits=[], affiliate_hits=[] all empty.

Permissions Breakdown

• storage low Stores extension settings locally; low risk.
• unlimitedStorage low Allows larger local storage quota; low risk on its own.
• scripting medium Enables programmatic script injection into pages; elevated when paired with <all_urls>.
• content_scripts <all_urls> high Content scripts run on every site the user visits; broad read/write access to page DOM.

Pillar Scores

Bookkeeping