Top Risks

• Broad host access (*://*/*) + scripting enables JS injection into every visited page.
• No CSP: DOM-XSS sinks (innerHTML) in two JS files are unmitigated by any content-security-policy.
• Free-webmail developer (gmail) with no verified business identity; chinadeveloper.net domain provenance unclear.
• Privacy policy discloses third-party data sharing without specific retention scoping for this extension.
• install_url_hijack=true: onInstalled opens an external URL, low-grade redirect signal.

Evidence

• broad_host_plus_scripting manifest host_permissions=[*://*/*] + scripting permission + content_scripts on <all_urls> — full page access.
• no_csp crx content_security_policy is null; MV3 default CSP applies but no explicit restriction hardens DOM sinks.
• dom_xss_sinks crx innerHTML user-controlled sink found in 2 JS files; no CSP amplifies FIX B risk (+2.0 code quality).
• free_webmail_developer store Developer email tiger.hu.liu@gmail.com — free webmail, no verified business domain.
• verified_publisher_featured store Extension is verified_publisher=true and is_featured_by_google=true — significant trust discount applied.
• install_url_hijack crx install_url_hijack=true; target null — onInstalled opens external URL, minor monetization signal.
• privacy_policy_third_party_sharing api Policy at chinadeveloper.net/en/privacy discloses data collection + third-party sharing; retention present.
• js_external_hosts crx js_external_hosts=[reactjs.org] — CDN/doc reference only; single US-hosted endpoint, low geo diversity.

Permissions Breakdown

• downloads medium Core function — downloads files to local disk; matches MediaDownloader category.
• storage low Persists settings locally; standard low-risk use.
• contextMenus low Adds right-click UI; no data exfil path.
• tabs medium Can read tab URLs and titles across all tabs.
• scripting high Injects scripts into any page via *://*/* host permission — broad execution surface.
• *://*/* high Broad host access on all HTTP/HTTPS origins; paired with scripting amplifies risk.
• <all_urls> (content_scripts) high Content scripts run on every page; captures page DOM including sensitive data.

Pillar Scores

Scoring History

Bookkeeping