Top Risks

• browsingData + scripting + broad host access: high-capability combo for a simple auto-refresh tool with unverifiable dev identity.
• Privacy policy hosted on CDN (cloudapi.stream), admits data collection and third-party sharing but not scoped to this extension — worst-case policy.
• install_url_hijack: onInstalled opens julia-info.kiev.ua, an unrelated Ukrainian domain not matching developer identity.
• JS contacts 3 distinct external domains (cloudapi.stream, julia-info.kiev.ua, dummysoftware.com) with no CSP restricting script execution.
• Free-webmail dev (gmail), no developer name listed, verified publisher badge carries limited weight given policy/network anomalies.

Evidence

• install_url_hijack crx onInstalled opens https://julia-info.kiev.ua/install/ — unrelated domain, classic monetization/tracking redirect.
• privacy_policy_generic_admits_sharing crx Policy fetched from cdn.cloudapi.stream; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy.
• js_external_hosts crx Extension contacts cloudapi.stream, julia-info.kiev.ua, dummysoftware.com — 3 distinct unrelated external domains.
• broad_host_plus_scripting_browsingData manifest http://*/ + https://*/ with scripting + browsingData: can inject code and delete data on every site.
• no_csp manifest content_security_policy is null; MV3 has default but no explicit restriction on connect-src.
• free_webmail_no_dev_name store Developer is viktornadiezhdin@gmail.com with no developer_name — free webmail, no verifiable business identity.
• verified_publisher store Verified publisher badge present but does not offset monetization signals and policy anomalies per v3.5 invariant 0c/E.
• install_url_target_mismatch crx Install redirect to julia-info.kiev.ua does not match developer email domain (gmail.com) or privacy policy domain (cloudapi.stream).

Permissions Breakdown

• tabs medium Access to tab URLs, titles; can enumerate user browsing.
• browsingData high Can delete cookies, history, cache — significant data destruction capability.
• notifications low Can display notifications; low direct risk.
• storage low Local extension storage; standard.
• scripting high Programmatic script injection into pages; high capability when paired with broad host access.
• alarms low Scheduling; standard for auto-refresh use case.
• http://*/ high Broad host permission covering all HTTP sites.
• https://*/ high Broad host permission covering all HTTPS sites.

Pillar Scores

Bookkeeping