Top Risks

• Broad host access (*://*/*) combined with cookies permission allows for session hijacking on any site.
• Use of chrome.debugger API grants powerful capabilities to inspect and modify page traffic.
• Widespread use of innerHTML with user-controlled variables creates a significant DOM-XSS risk, especially with no CSP.
• new Function() constructor allows for dynamic code execution, potentially running untrusted code.

Evidence

• permissions manifest High-risk combo: cookies + *://*/*. debugger_attach found in code.
• code_quality crx 16 code findings: 14x innerHTML DOM-XSS sinks, 1x new Function, 1x debugger_attach.
• reputation store Not a verified or featured publisher. Developer email on a custom domain (snutils.com).
• privacy store Scoped privacy policy found, detailing collection, purpose, retention, and 3rd-party sharing.
• network manifest Broad host access with external JS hosts observed, but category-justified (DevTools).
• webstore store 10,000 installs. No negative signals like operator clusters or threat intel hits.
• maintenance store Extension is actively maintained (updated 0 months ago).
• cve crx No CVE findings reported.

Permissions Breakdown

• activeTab low Grants temporary access to active tab after user interaction.
• declarativeContent low Used to take action depending on page content, typically benign.
• storage low Standard permission for storing extension settings locally.
• contextMenus low Adds items to the browser context menu.
• cookies high Access to all cookies. Paired with broad host access, allows session hijacking.
• sidePanel low Enables content in the browser's side panel.
• *://*/* (host) high Broad host access to all URLs, allows reading/modifying all website data.

Pillar Scores

Bookkeeping