Top Risks

• Brand impersonation: 'Google Docs' in title by unverified gmail dev with no Google affiliation.
• Privacy policy is Google's own account policy — not scoped to this extension at all; admits data collection and third-party sharing.
• 36-month stale extension (exactly at boundary) — no updates since Aug 2023, MV3 but abandoned.
• js_external_hosts include fb.me and reactjs.org — external JS references in a 2-file extension are anomalous.
• innerHTML DOM-XSS sink in main.js with no CSP; elevated risk per FIX B.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; dev is gmail user with no Google affiliation, confirmed_owner=false.
• privacy_policy_generic_google store Policy is myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true. Triggers +10.0 Privacy (D).
• maintenance_stale_36mo store months_since_update=36; maintenance pillar = 10.0 (>36mo boundary).
• free_webmail_developer store hidalgoivanhi@gmail.com — free webmail, no business website, no verified publisher.
• external_js_hosts crx js_external_hosts=[fb.me, reactjs.org] in a 2-file extension with no CSP.
• dom_sink_innerhtml_userctrl crx innerHTML sink in main.js; csp_present=false triggers FIX B → +2.0 code quality.
• is_featured_by_google store Featured badge present — applies -2.0 to reputation pillar.
• install_count_large store 800,000 installs — high reach amplifies impact of any compromise or privacy gap.

Permissions Breakdown

• storage low Stores user preferences (theme settings). Low risk, no data exfil surface.
• content_scripts: https://docs.google.com/document/* low Narrow host scope limited to Google Docs document URLs only.

Pillar Scores

Bookkeeping