Top Risks

• Broad host permissions (<all_urls>, file://*/*) with scripting access on all sites.
• Privacy policy admits data collection and third-party sharing without scoping to this extension.
• Free-webmail developer (amzbase@gmail.com) with no verified publisher status or business site.
• Low rating (2.1) and 13 months since update indicate poor quality/support.
• Low installs (406) with high-tier permissions — tail-attack surface.

Evidence

• broad_host_access manifest host_permissions include https://*/*, http://*/*, file://*/*, <all_urls> with scripting permission.
• privacy_policy_unscoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true (v3.5 D: +10).
• developer_identity store amzbase@gmail.com free webmail; verified_publisher=false; no business domain; reputation floor applies.
• low_rating store Rating 2.1 stars; rating_count not supplied (installs 406).
• stale_maintenance store Last updated Sept 8, 2025; 13 months since update (+6.0 maintenance).
• install_perm_anomaly api small_install_high_perm=true; tail_attack_surface=true (406 installs, high-tier perms).
• telemetry_only_network crx Only external host www.google-analytics.com; monetization_hits telemetry-tier only.
• clean_code_scan crx code_findings_raw empty; obfuscation_score=0.0; no CVEs; MV3.

Permissions Breakdown

• activeTab low Low-risk; temporary access to active tab after user gesture.
• tabs medium Can enumerate open tabs and URLs visited.
• scripting medium Can inject scripts into pages; combined with <all_urls> host access is broad.
• storage low Standard extension storage.
• <all_urls> host_permissions high https/http/file/<all_urls> grants page access on every site; HIGH paired with scripting.

Pillar Scores

Bookkeeping