Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — FocusTube: YouTube Focus & Distraction Blocker [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail Gmail dev with generic 'ChromeExtensions' name and no verified publisher status.
• Brand impersonation: YouTube mentioned in title/name but developer has no affiliation with Google.
• Description promises blocking but lacks declarativeNetRequest/webRequest — functional mismatch.
• Privacy policy hosted on free Google Sites without data retention disclosure.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; YouTube brand used, developer domain is gmail.com with no confirmed ownership.
• free_webmail_developer store Developer email binderpo343@gmail.com; developer name 'ChromeExtensions' is generic; no business website.
• description_permission_mismatch manifest Promises ad/distraction blocking but has no declarativeNetRequest or webRequest permission.
• privacy_policy_free_hosting api Policy on sites.google.com; scope_extension=true, data_collection=true, retention=false, third_party_silence=true.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts — low active-threat surface.
• content_script_youtube manifest Content script injected on *://*.youtube.com/*; only declared permission is storage.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.
• low_installs store Only 5 installs, 0 ratings — effectively unvetted by user community.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — FocusTube: YouTube Focus & Distraction Blocker [divergent] + malext.io malicious_extension_sentry; score 3.12 -> 5.62 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores user preferences; no exfiltration path without host access.
• content_scripts *://*.youtube.com/* medium Injects JS into all YouTube pages; can read/modify page content on that domain.

Pillar Scores

Bookkeeping