Top Risks

• Privacy policy fetch failed (HTTP error); policy adequacy cannot be verified — treated as no policy.
• Extension last updated 40 months ago; stale MV3 extension with no maintenance signals.
• new Function() constructor in bundled jscolor-2.4.5 library enables arbitrary code execution from parsed input.
• innerHTML sink with user-controlled variable in content.js; DOM-XSS risk on any visited page.
• No developer name listed; reduced accountability despite verified-publisher status.

Evidence

• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (fetch_error:HTTPError); policy treated as unavailable → Privacy pillar +10.0.
• stale_extension store Last updated Feb 2023; months_since_update=40 → Maintenance pillar +10.0 (>36mo).
• function_constructor_in_lib crx new Function() in jscolor-2.4.5/jscolor.min.js; arbitrary code exec risk from parsed option strings.
• dom_xss_sink crx innerHTML assigned from variable in content.js; no CSP present, amplifying DOM-XSS risk.
• no_csp manifest content_security_policy is null; dom_sink_innerhtml elevated to +2.0 per FIX B (no CSP).
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; Reputation floored at 2.0 per hard floor rule.
• no_developer_name store developer_name is empty string; reduced accountability signal.
• operator_cluster_dev_email_siblings api sibling_counts_by_dim.dev_email=2 but sibling_ids empty; no compound match so no +2.5 cluster penalty applied.

Permissions Breakdown

• activeTab low Scoped to user-activated tab only; fits color-picker use case.
• contextMenus low Adds right-click menu items; low standalone risk.
• scripting medium Allows script injection into pages; higher risk without broad host perms but still notable.
• storage low Local data storage only; no exfil risk on its own.

Pillar Scores

Bookkeeping