Top Risks

• Google brand impersonation: dev 'googloc' uses Gmail address, claims Google-branded malware removal.
• Privacy policy points to Google's own policy — no scope to this extension; classified as data_collection+third_party_sharing without extension scope.
• Startup-page override silently redirects browser launch to googloc.com — persistent forced navigation.
• DOM-XSS sink (innerHTML from variable) in content_script.js with no CSP — exploitable if page data is attacker-controlled.
• 18-month stale extension from unverified Gmail developer with only 12 installs — classic tail-attack-surface.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'googloc' mimics Google, confirmed_owner=false, dev email is Gmail.
• startup_page_override manifest chrome_settings_overrides.startup_pages=['https://googloc.com/start'] — forced browser-launch navigation.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_xss_sink crx innerHTML assigned from variable in content_script.js; csp_present=false amplifies risk.
• free_webmail_dev store Developer email appgoogloc@gmail.com; no verified publisher; no business website.
• stale_extension store months_since_update=18; only 12 installs; unverified developer.
• external_js_hosts crx js_external_hosts include stackoverflow.com and www.googloc.com — unrelated external host.
• description_promise_mismatch store Description claims malware removal but permissions are near-empty; only startup override declared.

Permissions Breakdown

• chrome_settings_overrides.startup_pages medium Overrides browser startup page to googloc.com — forced navigation on browser open.

Pillar Scores

Bookkeeping