Top Risks

• Broad host access (<all_urls>) with network modification capability on a low-install extension
• Free-webmail developer (gmail) with no business website and no developer name
• DOM-XSS sink (innerHTML) in popup.js with no CSP present
• Small install base (531) with high-tier permissions creates tail-attack surface

Evidence

• broad_host_access manifest host_permissions includes <all_urls> with declarativeNetRequest, enabling header modification on any site.
• free_webmail_dev store Developer email is gmail.com; no developer name provided; no business website linked.
• verified_publisher store Web Store verified publisher badge present.
• dom_xss_sink crx innerHTML assignment from variable in popup.js; no CSP present.
• low_install_high_perm store 531 installs with high-tier declarativeNetRequest + <all_urls> permissions.
• privacy_policy_scoped api Privacy policy fetched and scoped to extension; data collection disclosed; retention not specified.

Permissions Breakdown

• declarativeNetRequest medium Can modify network requests/responses. Required for stated header modification function.
• declarativeNetRequestFeedback low Read-only feedback on matched rules; minimal risk surface.
• storage low Local storage for rule profiles and settings.
• <all_urls> (host_permissions) high Broad host access to modify headers on any site; justified by stated function but high capability.

Pillar Scores

Bookkeeping