Top Risks

• Netflix brand impersonation by unverified gmail developer with no confirmed owner relationship.
• Privacy policy is generic Google account policy (not scoped to extension); admits data collection and third-party sharing.
• Free webmail developer (gmail.com), no business website, no verified publisher badge.
• No CSP on MV3 extension with content script injected into Netflix pages.
• Developer identity unverifiable; confirmed_owner=false for Netflix brand use.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[netflix], confirmed_owner=false, dev domain=gmail.com.
• privacy_policy_generic api Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true per classification.
• free_webmail_developer store Developer email konstantin.mueller.dev@gmail.com; no business domain; no verified publisher badge.
• no_csp manifest content_security_policy=null on MV3 extension with content scripts on netflix.com.
• installs_10k store 10,000 installs; moderate blast radius for a brand-impersonating entertainment extension.
• content_script_scope manifest content_scripts_matches=[*://www.netflix.com/*]; scoped to Netflix only, matches stated UW-display function.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, js_file_count=2; no malicious patterns detected.
• no_threat_intel_hits api bad_host_hits=[], monetization_hits=[], affiliate_hits=[], sibling_count=0.

Permissions Breakdown

• storage low Stores local settings/preferences; no data exfil risk alone.
• content_scripts *://www.netflix.com/* low Scoped to netflix.com only; matches stated function.

Pillar Scores

Bookkeeping