Top Risks

• <all_urls> host permission + content_scripts on all sites with contentSettings permission allows broad access to camera/mic settings.
• dynamic <script src> creation in options.js combined with innerHTML sinks in 3 files creates DOM-XSS attack surface.
• Privacy policy fetched but scope_extension==false; policy covers company data broadly, not this extension specifically.
• No developer name listed; uninstall URL redirects to flonnect.canny.io (third-party feedback); install URL hijack detected.
• Description promises recording but lacks tabCapture/desktopCapture permissions — functional mismatch raises questions.

Evidence

• host_permissions_all_urls manifest <all_urls> host_permissions + content_scripts on all URLs; justified partly by screen-recorder category.
• contentSettings_permission manifest contentSettings can override per-site camera/mic/popup permissions — elevated for a recorder extension.
• code_dynamic_script_src crx options.js: dynamic <script src=...> creation detected; potential remote code loading vector.
• code_innerhtml_sinks crx innerHTML assignments from variables in options.js, popup.js, manage.js — DOM-XSS sinks across 3 files.
• privacy_policy_scope api Policy fetched (26KB), data_collection=true, retention=true, but scope_extension=false; not scoped to extension.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() points to flonnect.canny.io (third-party domain).
• description_permission_mismatch store Extension promises recording but lacks tabCapture/desktopCapture; likely using alternate capture API.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reduces reputation risk floor to 2.0.

Permissions Breakdown

• tabs medium Can read tab URLs and titles; moderate risk for a screen recorder.
• contentSettings high Can modify per-site content settings (camera, mic, popups) — elevated capability.
• storage low Local data persistence; low standalone risk.
• downloads medium Can trigger file downloads; needed for saving recordings.
• scripting medium Can inject scripts into pages; paired with <all_urls> increases reach.
• contextMenus low UI addition only; no data access.
• <all_urls> (host_permissions) high Content scripts on all URLs; broad reach for a recorder. Partially justified by category.

Pillar Scores

Bookkeeping