Top Risks

• Privacy policy is generic Google policy with no extension scope
• Broad <all_urls> host access with scripting capability
• Multiple innerHTML DOM-XSS sinks without CSP protection
• Russian free webmail developer with no business identity

Evidence

• privacy_policy_generic store Privacy policy is generic Google policy, not extension-specific, admits data collection and 3rd-party sharing
• broad_host_access crx host_permissions includes <all_urls> with scripting permission
• developer_email_freemail store Developer uses free Russian webmail (mail.ru) with no developer name or business site
• dom_xss_sinks crx 11 innerHTML assignment sinks detected, no CSP present
• function_constructor crx d3.js library uses new Function() constructor
• multiple_external_hosts crx 12 external hosts contacted including Russian platforms (vk.com, dzen.ru, rutube.ru)
• brand_impersonation_flag api Brand mention analysis flags 'meta' as potential impersonation (not confirmed owner)
• verified_publisher_featured store Extension has verified publisher badge and is featured by Google

Permissions Breakdown

• scripting medium Can execute scripts in tabs when combined with activeTab
• activeTab low Temporary access to current tab only
• storage low Local data storage
• tabs medium Can access tab URLs and metadata
• declarativeNetRequest medium Can block/modify network requests
• sidePanel low UI panel access only
• contextMenus low Context menu integration
• unlimitedStorage low Expanded local storage quota
• host_permissions:<all_urls> high Broad access to all websites combined with scripting capability

Pillar Scores

Bookkeeping