Top Risks

• Privacy policy hosted on unrelated domain (randevuservisi.com) with no extension scope — fails adequacy check.
• Uninstall URL hijack to alisincar.github.io — third-party redirect on removal.
• Content scripts injected on http://*/* and https://*/* (broad host) combined with clipboardRead — full clipboard exfil surface.
• No CSP declared (MV3 default only) with innerHTML DOM-XSS sink in popup.js.
• Developer name absent; privacy policy domain differs from developer domain (mozared.com vs randevuservisi.com).

Evidence

• uninstall_url_hijack crx setUninstallURL points to alisincar.github.io — third-party domain redirect on uninstall.
• content_scripts_broad manifest content_scripts_matches includes http://*/* and https://*/* — all sites covered.
• privacy_policy_off_domain store Privacy URL randevuservisi.com does not match dev domain mozared.com; scope_extension==false.
• dom_sink_innerhtml_userctrl crx popup.js: innerHTML written from variable — DOM-XSS risk with no CSP guard.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• developer_name_missing store developer_name is empty string; only email ali@mozared.com available.
• verified_publisher store Extension carries verified publisher badge and is featured by Google — reputation credit applied.
• js_external_hosts crx External hosts in fingerprint: alisincar.github.io, example.com, example.org — 2 countries (CA, US).

Permissions Breakdown

• clipboardRead high Reads all clipboard content — core function but high sensitivity; captures any copied passwords/PII.
• clipboardWrite medium Can overwrite clipboard contents silently.
• scripting medium Programmatic script injection into pages; paired with broad content_scripts host match.
• downloads medium Can trigger file downloads without user confirmation.
• activeTab medium Access to active tab content on click; lower risk than all_urls but still page-level.
• storage low Local persistence of clipboard history; expected for this category.
• contextMenus low Adds context menu entries; low standalone risk.
• offscreen low Offscreen document for clipboard ops; expected use-case but adds background surface.

Pillar Scores

Bookkeeping