Top Risks

• Instagram brand impersonation by free-webmail developer with no business identity.
• cookies + webRequest on instagram.com enables session token theft and request interception.
• Privacy policy is Google's own policy — not scoped to this extension; data_collection+third_party_sharing admitted.
• No CSP combined with innerHTML DOM-XSS sink and new Function() constructor raises code-execution risk.
• install_url_hijack opens instagram.com on install; external hosts include unknown domains check.statatracker.com and user.firstassay.com.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer is gmail user with no confirmed ownership of Instagram brand.
• free_webmail_developer manifest developer_email=stipestoykovich@gmail.com; developer_name empty; no business domain.
• cookies_plus_broad_host manifest cookies + webRequest + *://*.instagram.com/* enables full session token read on Instagram.
• unscoped_privacy_policy store Privacy URL points to Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp_with_dom_sink crx csp_present=false; code has innerHTML userctrl sink and new Function() — DOM-XSS and code-exec risk.
• suspicious_external_hosts crx js_external_hosts includes check.statatracker.com and user.firstassay.com — unknown third-party domains.
• install_url_hijack crx install_url_hijack=true; target=https://www.instagram.com/ on install.
• featured_by_google store is_featured_by_google=true; provides minor trust signal but does not offset impersonation+privacy risks.

Permissions Breakdown

• storage low Stores extension settings locally.
• tabs medium Can read tab URLs and metadata across browsing session.
• cookies high Can read/write cookies; paired with instagram host = session token access.
• webRequest high Intercepts all network requests to instagram.com.
• downloads medium Triggers file downloads to user's machine.
• *://*.instagram.com/* high Broad host access on instagram.com enables cookie + content exfil on every page.

Pillar Scores

Bookkeeping