Top Risks

• Privacy policy is hosted on stopallads.com (unrelated domain), not the developer's own domain; third-party sharing admitted, no retention period disclosed.
• install_url_hijack=true: onInstalled opens tabDialog.html to a potentially user-facing redirect page.
• small_install_high_perm anomaly: only 825 installs with broad host permissions and content scripts on all URLs.
• 7 distinct external JS hosts including AWS API Gateway and cdn.systweak.com; broad network surface for a password manager.
• No CSP on MV3 extension with broad host access and multiple external endpoints; increases XSS risk.

Evidence

• privacy_policy_on_unrelated_domain store Privacy policy URL is http://www.stopallads.com/en/privacy — an ad-blocking product domain, not tweakingtechnologies.com. Third-party sharing admitted.
• install_url_hijack crx chrome.runtime.setUninstallURL or onInstalled opens common/html/tabDialog.html; install_url_hijack=true per listing.
• broad_host_plus_content_scripts manifest host_permissions [*://*/*, <all_urls>] + content_scripts on <all_urls>; injects into every page the user visits.
• multiple_external_hosts crx 7 external JS hosts: AWS API GW, cdn.systweak.com, vault.tweakpass.com, ws1apm.systweak.com, github.com, google.com, tweakpass.com.
• no_csp manifest content_security_policy is null on MV3 extension with external hosts and broad content scripts.
• small_install_high_perm_anomaly api install_perm_anomaly.small_install_high_perm=true; 825 installs with HIGH-tier host permissions.
• verified_publisher store verified_publisher=true; tweakingtechnologies.com resolves and is not throwaway. Partial trust credit applied.
• retention_not_disclosed store privacy_policy_classification.retention=false; policy admits data_collection and third_party_sharing but no retention period.

Permissions Breakdown

• storage low Needed for local vault storage; standard for password managers.
• webNavigation medium Monitors navigation events across all tabs; broad visibility.
• tabs medium Can read tab URLs and titles; combined with host access this is high reach.
• activeTab low Limited to user-triggered interaction on current tab.
• contextMenus low Adds right-click fill/save options; benign for password managers.
• notifications low UI alerts; low risk.
• *://*/* high Broad host access; content scripts inject on every page including banking sites.
• <all_urls> high Redundant with *://*/* but explicit full-URL host permission including file://.
• content_scripts: <all_urls> high Content scripts run on every page — password autofill requires it but increases risk surface.

Pillar Scores

Bookkeeping