Top Risks

• Privacy policy fetched but scope_extension==false AND data_collection+third_party_sharing==true: generic policy admits broad data sharing without scoping to this extension.
• Uninstall URL hijack detected — extension registers a 3rd-party URL on uninstall (+3.0 webstore signal).
• DOM innerHTML sink (dom_sink_innerhtml_userctrl) with no CSP — potential XSS surface on all pages visited.
• <all_urls> host permission + content_scripts on all URLs gives full page read/write across every site.
• No CSP present on MV3 extension with 12 external JS hosts including social/ad-adjacent endpoints.

Evidence

• privacy_policy_generic_broad api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy score per v3.5 rule D.
• uninstall_url_hijack crx uninstall_url_hijack=true; +3.0 webstore signal applied.
• dom_sink_innerhtml_no_csp crx dom_sink_innerhtml_userctrl in assets/index-DjtMcojI.js; csp_present=false triggers +2.0 code quality (FIX B).
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reputation discounts applied, floored at 2.0.
• adblock_justified_broad_host manifest <all_urls> + scripting + declarativeNetRequest justified by Adblock category; -1.5 permission discount applied.
• external_hosts_12 crx 12 distinct JS external hosts including Twitch, Reddit, Facebook, YouTube, standsapp.org subdomains.
• no_csp_mv3 manifest content_security_policy=null on MV3; no +2.0 MV2 penalty but no CSP protection either.
• high_installs_popular store 3,000,000 installs, rating 4.8, no review red flags, no CVEs, no bad hosts.

Permissions Breakdown

• storage low Standard local config persistence.
• unlimitedStorage low Needed for filter-list caching — expected for adblock.
• activeTab low Limited to current tab on user action.
• scripting medium Can inject scripts into pages; paired with <all_urls> is broad but core to adblocker function.
• contextMenus low UI surface only.
• alarms low Filter-list update scheduling.
• notifications low Low-impact user alerts.
• tabs medium Can read tab URLs across all tabs.
• webNavigation medium Monitors navigation events; typical for adblockers.
• declarativeNetRequest medium Core blocking mechanism — expected for MV3 adblocker.
• declarativeNetRequestFeedback medium Reads which rules matched — privacy-adjacent but standard.
• <all_urls> (host_permission) high Full page access on all sites; justified by adblock category.

Pillar Scores

Scoring History

Bookkeeping