Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Developer uses free Gmail with no business identity; no verified publisher badge.
• Extension stale at exactly 24 months with no changelog.
• No CSP declared (MV3 mitigates partially but adds +2.0 network signal).
• Low install count (1,000) from unverifiable individual developer limits trust signals.

Evidence

• privacy_policy_generic store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) → Privacy pillar +10.
• free_webmail_developer store Developer email faijansaifi99@gmail.com; no business domain; no verified publisher badge → Reputation penalty.
• no_csp manifest content_security_policy is null; MV3 applies but triggers +2.0 Network behavior signal per v2 rule.
• maintenance_stale store Last updated June 2024, months_since_update=24 → Maintenance +6.0 (12-24 month band).
• no_bad_hosts crx threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty; js_external_hosts empty.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; 1 JS file scanned with no risky patterns.
• no_cve_findings crx cve_findings_raw empty; no bundled vulnerable libraries detected.
• minimal_permissions manifest Only activeTab + scripting declared; no host_permissions, no content_scripts_matches, no overrides.

Permissions Breakdown

• activeTab low Scoped to user-activated tab only; limited blast radius.
• scripting medium Allows JS injection into pages; paired with activeTab limits scope but still capable.

Pillar Scores

Bookkeeping