Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy fetched but scope_extension=false AND admits data_collection+third_party_sharing → privacy pillar 10.0
• nativeMessaging with unrecognized publisher (+3.0 perm) combined with <all_urls> cookies/browsingData/contentSettings creates critical capability stack
• management permission can enumerate and disable other security extensions
• No developer name listed; no verified-publisher badge despite 11M installs

Evidence

• privacy_policy_scope_extension_false_with_collection_and_sharing api Policy fetched (117k chars) but scope_extension=false, data_collection=true, third_party_sharing=true → privacy score 10.0
• native_messaging_unrecognized_publisher manifest has_native_messaging=true, publisher_recognized=false — companion app identity unverifiable
• high_capability_permission_stack manifest cookies+browsingData+contentSettings+management+<all_urls> together represent near-total browser control
• no_csp_mv3_dom_xss_sinks crx csp_present=false + dom_sink_innerhtml_userctrl in contentScript.bundle.js running on <all_urls>
• no_developer_name_no_verified_publisher store developer_name empty, verified_publisher=false, is_featured_by_google=true but capability gate applies
• external_js_hosts crx js_external_hosts: feross.org, www.instagram.com — unexpected for a security tool
• rating_3_6_at_11m_installs store Rating 3.6 at 11M installs is below threshold; no review red flags flagged but low score notable
• cve_findings_clean crx cve_findings_raw empty; no CVE exposure detected

Permissions Breakdown

• storage low Standard local data storage.
• unlimitedStorage low Extended storage quota; low standalone risk.
• management high Can enumerate/disable/enable other installed extensions.
• tabs medium Can read URLs and titles of open tabs.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• downloads medium Can trigger and manage file downloads.
• downloads.shelf low UI control over downloads shelf only.
• downloads.open medium Can open downloaded files on disk.
• notifications low Desktop notifications; low risk alone.
• webNavigation medium Observes all navigation events across tabs.
• contextMenus low Adds right-click menu items.
• contentSettings high Can override per-site JS/plugin/cookie settings globally.
• browsingData high Can delete history, cookies, cache across all sites.
• history medium Full read/write access to browsing history.
• nativeMessaging high IPC with a native app; publisher not recognized — high risk.
• idle low Detects user idle state only.
• alarms low Scheduled background tasks.
• cookies high Read/write cookies for all origins via <all_urls>.
• <all_urls> (host) high Content scripts injected into every site; full data access.

Pillar Scores

Bookkeeping