Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware] (+2.0, capped).
• new Function() constructor present in all 6 JS files — dynamic code execution risk with broad host access.
• Privacy policy is only 16 chars, not scoped to this extension, and data_collection=false with no retention info — effectively inadequate.
• Free-webmail developer (gmail) with no developer name; verified/featured discounts partially offset but not eliminated.
• Broad host permissions (http://*/*, https://*/*) + scripting allow arbitrary content injection on every site.

Evidence

• free_webmail_developer store Developer email tayloreolivian4@gmail.com is free webmail; no developer name provided.
• verified_publisher_featured store Extension has verified_publisher=true and is_featured_by_google=true; discount capped at -1.0 due to stale 19mo.
• broad_host_permissions manifest host_permissions include http://*/* and https://*/* combined with scripting permission.
• function_constructor_all_files crx new Function() constructor found in all 6 scanned JS files; potential dynamic code execution surface.
• privacy_policy_inadequate api Policy fetched but only 16 chars, scope_extension=false, data_collection=false, third_party_silence=true.
• stale_update store Last updated January 22, 2025; 19 months since update triggers maintenance risk.
• no_csp manifest content_security_policy is null; no CSP declared on MV3 extension.
• cve_clean crx cve_findings_raw is empty; no known CVEs in bundled libraries.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware]; score 5.55 -> 7.55 (+2.0 cap 2.5).

Permissions Breakdown

• storage low Standard local state persistence; low risk.
• unlimitedStorage low Allows larger local storage quota; minimal risk.
• tabs medium Can read tab URLs/titles across all open tabs.
• favicon low Read-only favicon access; low risk.
• scripting high Combined with <all_urls> host perms, can inject JS into any page.
• contextMenus low UI surface addition only; low risk.
• system.memory low Read-only system memory info; low risk.
• http://*/* high Broad host access to all HTTP sites; enables content injection.
• https://*/* high Broad host access to all HTTPS sites; enables content injection.

Pillar Scores

Bookkeeping