Top Risks

• Broad host_permissions (http://*/*, https://*/*) + content_scripts injected on all HTTPS sites — full page read/write on every visited site.
• No CSP declared (MV3) combined with 4x innerHTML DOM-XSS sinks across popup and Ledger bundles — elevated XSS risk for a crypto wallet.
• Privacy policy fetched but scope_extension==false and data_collection==false — policy does not address this extension specifically.
• Uninstall URL hijack flag set — extension registers a third-party URL on removal.
• External JS hosts include a.com and reactjs.org — non-canonical endpoints for a wallet; reactjs.org does not serve JS.

Evidence

• broad_host_permissions manifest http://*/* and https://*/* grant full read/write on all sites; scripting permission amplifies this.
• content_scripts_all_https manifest content_scripts matches https://*/* — auto-injected on every HTTPS page user visits.
• no_csp crx content_security_policy is null; MV3 default restricts eval but not network fetches or innerHTML.
• dom_xss_sinks crx 4 files with innerHTML user-controlled sink; no CSP present amplifies DOM-XSS risk per FIX B.
• uninstall_url_hijack crx uninstall_url_hijack==true; target URL not captured but registers third-party redirect on removal.
• privacy_policy_generic store Policy fetched (100787 chars) but scope_extension==false; does not address what this wallet extension collects.
• verified_publisher store verified_publisher==true with zerion.io domain resolving; partial trust discount applied.
• external_js_hosts crx js_external_hosts includes a.com, reactjs.org, api.hyperliquid.xyz, links.ethers.org — 4 distinct domains.

Permissions Breakdown

• activeTab low Scoped to user-initiated tab interaction only.
• alarms low Scheduling only, no data access.
• scripting medium Can inject JS into pages; risk elevated by broad host_permissions.
• sidePanel low UI surface only, low intrinsic risk.
• storage low Local extension storage, no cross-site exposure.
• unlimitedStorage low Quota expansion only, no additional data access.
• host_permissions: http://*/*, https://*/* high Broad all-sites access; scripting can read/modify any page content.
• content_scripts: https://*/* high Auto-injected on all HTTPS pages; persistent read/write of every visited site.

Pillar Scores

Bookkeeping