Top Risks

• Brand impersonation: extension uses 'Telegram' brand but developer domain wwevents.fun is unrelated and unverified owner.
• <all_urls> host permission far exceeds stated Telegram-only function; enables injection into any site user visits.
• install_url_hijack to chrome://flags/#enable-panels — opening privileged Chrome URL on install is a trust-abuse indicator.
• Privacy policy admits data collection and third-party sharing but retention is undisclosed; scope is extension-specific.
• 12 external JS hosts in fingerprint (GitHub, Instagram, LinkedIn, YouTube, Twitter, etc.) vastly exceeds Telegram wrapper scope.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands=['telegram']; dev domain wwevents.fun has no confirmed ownership of Telegram.
• install_url_hijack crx install_url_hijack=true; target=chrome://flags/#enable-panels — opens privileged Chrome settings page on install.
• all_urls_host_permission manifest <all_urls> declared in host_permissions alongside scripting; allows injection into every site, not just telegram.org.
• scope_mismatch_external_hosts crx 12 external JS hosts including instagram.com, linkedin.com, youtube.com, twitter.com — unrelated to Telegram wrapper.
• privacy_policy_data_sharing store Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• verified_publisher_claimed store verified_publisher=true but developer_name empty, domain wwevents.fun unrelated to Telegram brand.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in options/lib/mootools-core.js; CSP present mitigates but bundled legacy lib is risk.
• low_rating store Rating 3.3; install count 40,000; below-average user satisfaction for reach.

Permissions Breakdown

• <all_urls> high Broad host access to all URLs; far exceeds stated Telegram-only function.
• *://*.telegram.org/* high Explicit host permission on Telegram origin; allows script injection into the app.
• *://*.wwevents.fun/* medium Access to developer's own domain; could be used for C2 or data exfil.
• scripting high Programmatic script injection into pages, especially dangerous paired with <all_urls>.
• activeTab medium Access to active tab content on user gesture; lower risk but adds surface area.
• notifications low Can display notifications; low direct risk.
• contextMenus low Adds context menu items; low risk.
• unlimitedStorage low Can store unlimited data locally; enables caching of sensitive data.
• storage low Standard key-value storage; low risk.
• system.display medium Access to display configuration; unusual for a messaging wrapper, scope mismatch.

Pillar Scores

Bookkeeping