Top Risks

• <all_urls> host permission with content_scripts on all pages — full page read/write across every site visited.
• Privacy policy is Google's generic account policy; not scoped to this extension, admits data collection and 3rd-party sharing (+10.0 privacy).
• install_url_hijack and uninstall_url_hijack both true — unsolicited navigation on install/uninstall.
• eval() on variable input in bundled JS with no CSP — arbitrary code execution risk.
• Free-webmail dev (gmail), no developer name, no verified publisher — unaccountable operator.

Evidence

• host_permission_all_urls manifest <all_urls> in host_permissions + content_scripts_matches; extension runs on every site.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — generic Google policy, not scoped to extension.
• install_and_uninstall_url_hijack crx install_url_hijack=true, uninstall_url_hijack=true; third-party navigation triggered on lifecycle events.
• eval_user_input crx eval(funcstr) in ede2bd6923eabc2d23b6.js; no CSP to mitigate.
• free_webmail_no_devname store Developer email editorhong21@gmail.com, developer_name empty, not verified publisher.
• install_perm_anomaly api 64 installs + HIGH-tier permission (<all_urls>) — tail attack surface flagged.
• external_js_host crx js_external_hosts includes softoolhub.com; no CSP restricting script sources.
• stale_12_to_24mo store months_since_update=13; maintenance pillar +6.0.

Permissions Breakdown

• activeTab low Scoped to user-invoked tab interaction; low standalone risk.
• storage low Local data persistence only.
• sidePanel low UI surface only, no data access.
• contextMenus low Adds right-click menu items; low risk alone.
• downloads medium Can initiate file downloads to user system.
• <all_urls> (host_permission) high Content script injected on every page; broad read/write access to all sites.

Pillar Scores

Bookkeeping