Top Risks

• Developer email is free-webmail Gmail with no verified business; dev domain not CT-checked.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension → Privacy pillar 10.0.
• Uninstall URL hijack redirects to 10xprofit.io/tools with UTM tracking, indicating monetization intent.
• Brand impersonation: extension uses 'Amazon' branding but developer is not affiliated with Amazon.
• External JS hosts include jsdelivr.com and chartjs.org (CDN remote code); no CSP on MV3.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://10xprofit.io/tools/?utm_source=chrome-extension (monetization redirect).
• privacy_policy_generic_with_third_party_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy score.
• brand_impersonation store brand_mention.is_impersonation=true; developer domain gmail.com, confirmed_owner=false.
• free_webmail_developer store Developer email 10xprofitio@gmail.com; no verified publisher; no featured badge.
• external_js_cdn_hosts crx js_external_hosts includes jsdelivr.com and chartjs.org; no CSP — remote code risk.
• install_url_hijack manifest onInstalled opens welcome.html (local); lower severity but combined with uninstall hijack raises monetization concern.
• geo_diversity_4_countries api JS hosts span CN, FR, IE, US (4 countries); category PriceTracker not in geo-diversity exemption list.
• maintenance_3_to_6_months store months_since_update=6; borderline 3-6mo band (+1.5).

Permissions Breakdown

• storage low Used for local price history storage; low risk for PriceTracker.
• notifications low Price-drop alerts; low risk, scoped function.
• *://*.amazon.*//* (24 host_permissions) medium Broad host access across all Amazon TLDs; justified for global price tracker but still medium risk.

Pillar Scores

Bookkeeping