Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Downloader For Instagram [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Instagram brand impersonation by free-webmail developer with no business identity.
• cookies + webRequest on instagram.com enables session token theft and request interception.
• Privacy policy is Google's own policy — not scoped to this extension; data_collection+third_party_sharing admitted.
• No CSP combined with innerHTML DOM-XSS sink and new Function() constructor raises code-execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer is gmail user with no confirmed ownership of Instagram brand.
• free_webmail_developer manifest developer_email=stipestoykovich@gmail.com; developer_name empty; no business domain.
• cookies_plus_broad_host manifest cookies + webRequest + *://*.instagram.com/* enables full session token read on Instagram.
• unscoped_privacy_policy store Privacy URL points to Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp_with_dom_sink crx csp_present=false; code has innerHTML userctrl sink and new Function() — DOM-XSS and code-exec risk.
• suspicious_external_hosts crx js_external_hosts includes check.statatracker.com and user.firstassay.com — unknown third-party domains.
• install_url_hijack crx install_url_hijack=true; target=https://www.instagram.com/ on install.
• featured_by_google store is_featured_by_google=true; provides minor trust signal but does not offset impersonation+privacy risks.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Downloader For Instagram [data-theft] + malext.io malicious_extension_sentry; score 6.14 -> 8.64 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores extension settings locally.
• tabs medium Can read tab URLs and metadata across browsing session.
• cookies high Can read/write cookies; paired with instagram host = session token access.
• webRequest high Intercepts all network requests to instagram.com.
• downloads medium Triggers file downloads to user's machine.
• *://*.instagram.com/* high Broad host access on instagram.com enables cookie + content exfil on every page.

Pillar Scores

Bookkeeping