Top Risks

• Privacy policy is Google's generic corporate policy (policies.google.com) — scope_extension==false, data_collection==true, third_party_sharing==true: triggers +10.0 privacy under v3.5 rule D.
• Extension not updated in 25 months — stale but still widely deployed to 3M users.
• innerHTML DOM-XSS sink in popup-compiled.js; no CSP present to mitigate.
• v3.5 invariant 0c applies: verified-publisher discount capped at -1.0 due to months_since_update > 18.
• MV3 with no CSP: no +2.0 network penalty (MV3 exempt), but DOM sink risk elevated by csp_present==false.

Evidence

• developer_identity store Email scholar-chrome-extensions@google.com; brand_mention.confirmed_owner=true; is_impersonation=false; recognized Google org.
• privacy_policy_generic api policies.google.com policy: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (rule D).
• maintenance_stale store Last updated May 2024; 25 months since update → +6.0 maintenance. Invariant 0c caps org discount to -1.0.
• dom_xss_sink crx popup-compiled.js: innerHTML assigned from variable with no CSP; obfuscation_score=0.0; no eval/fetch findings.
• host_permissions_narrow manifest host_permissions limited to *://scholar.google.com/ — single first-party domain, minimal reach.
• featured_by_google store is_featured_by_google=true; -2.0 reputation discount applied (featured badge).
• no_bad_hosts api threat_intel: bad_host_hits=[], affiliate_hits=[], monetization_hits=[], looks_throwaway=false.
• cve_clean crx cve_findings_raw=[]; js_libraries_detected=[]; CVE pillar=0.0.

Permissions Breakdown

• storage low Local preference storage; low exfil risk in isolation.
• activeTab low Scoped to user-initiated action on current tab only.
• scripting medium Allows JS injection into pages; paired with narrow host_permissions limits blast radius.
• *://scholar.google.com/ (host) low Single first-party Google domain; narrow and matches stated function.

Pillar Scores

Scoring History

Bookkeeping