Top Risks

• debugger permission used in code: can intercept all page data, XHR, and DOM across 10M installs
• nativeMessaging to unrecognized companion app bypasses browser sandbox
• browsingData + <all_urls> enables full session cookie and history deletion
• Privacy policy fetch failed — data handling unverifiable for this extension
• Rating 2.0 indicates significant user-reported dissatisfaction at scale

Evidence

• debugger_attach confirmed in code crx background.js calls chrome.debugger.attach({tabId}) — highest-risk API, can read all network/DOM.
• High-capability permission cluster manifest debugger + browsingData + nativeMessaging + scripting + <all_urls> — full-compromise surface.
• Recognized organization (Microsoft) store developer_domain microsoft.com resolves; brand_mention.confirmed_owner=true; not impersonation.
• Privacy policy unfetchable api privacy_policy_classification.fetched=false (fetch_error:HTTPError); scored as +10.0 privacy pillar.
• native_messaging publisher_recognized=true crx Companion app publisher is recognized — +0 penalty on native messaging sanity check.
• No CVEs, no obfuscation, no external JS hosts crx cve_findings_raw empty; obfuscation_score=0.0; js_external_hosts empty.
• Capability gate blocks recognized-org discount manifest v2 rule 0b: debugger+browsingData+nativeMessaging+broad host are HIGH-impact; -2.0 org discount blocked.
• Low rating at massive scale store Rating 2.0 across 10M installs is notable negative signal, though no review red flags matched.

Permissions Breakdown

• scripting medium Can inject scripts into pages; medium risk on its own.
• debugger high Full debugger protocol access; can intercept all page data and network traffic.
• tabs medium Access to tab URLs and metadata across all open tabs.
• browsingData high Can delete cookies, cache, and history — broad data destruction capability.
• nativeMessaging high Communicates with native desktop app; escape from browser sandbox.
• webNavigation medium Observes all navigation events across all URLs.
• <all_urls> high Host permission covering all URLs; amplifies every other permission.
• http://*/* high Redundant broad host; covered by <all_urls> — anti-double-count applied.
• https://*/* high Redundant broad host; covered by <all_urls> — anti-double-count applied.

Pillar Scores

Bookkeeping