Top Risks

• Privacy policy admits data collection and third-party sharing without scoping to this extension (generic policy, +10 privacy pillar).
• Extension is 20 months stale — no updates since Oct 2024, approaching abandon threshold.
• Content script on <all_urls> with innerHTML user-controlled sink introduces DOM-XSS risk on every visited page.
• No CSP present (MV3 so no +2 Network penalty, but amplifies code quality DOM-sink risk).
• Developer name absent in listing; verified publisher status partially offsets but reputation floor applies.

Evidence

• privacy_policy_generic api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D clause).
• verified_publisher store Verified publisher badge present; reputation floored at 2.0 per hard floor rule.
• maintenance_stale store 20 months since last update → +6.0 maintenance pillar (12-24mo band).
• dom_xss_sink crx content.js assigns translation variable directly to tooltip.innerHTML; no CSP to mitigate.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; broad reach but category discount applied (TranslationTool).
• no_csp manifest content_security_policy is null; MV3 so no +2 network penalty but amplifies DOM-sink risk.
• threat_intel_clean api bad_host_hits=[], monetization_hits=[], affiliate_hits=[]; developer domain resolves, not throwaway.
• developer_name_missing store developer_name is empty string; email domain conveythis.com resolves and matches privacy policy domain.

Permissions Breakdown

• activeTab low Grants access only to the current tab on user action; low blast radius.
• contextMenus low Adds right-click menu items; no data access.
• storage low Local extension storage only; no cross-origin data exposure.
• host_permissions: https://translate.google.com/* low Scoped to Google Translate API; matches stated translation function.
• host_permissions: https://translate.googleapis.com/* low Scoped to Google Translate API; matches stated translation function.
• content_scripts_matches: <all_urls> medium Content script runs on all pages; broad reach offset by TranslationTool category discount.

Pillar Scores

Scoring History

Bookkeeping