Top Risks

• MANAGEMENT PERMISSION: extension can enumerate and disable other installed extensions (incl. security and privacy tools).
• debugger + scripting + <all_urls> + userScripts = near-total browser control from a gmail-dev extension
• new Function() executes arbitrary user-supplied code strings in background service worker
• browsingData + management permissions allow destructive actions against browser state and other extensions
• Privacy policy is Google's own generic account policy — does not scope to this extension at all (scored +10.0)

Evidence

• HIGH permissions cluster manifest debugger, management, scripting, browsingData, userScripts all declared alongside <all_urls> host permission.
• function_constructor in background.js crx new Function(userCode)() executed in background — arbitrary code execution from stored shortkey scripts.
• Generic Google privacy policy store Privacy URL points to myaccount.google.com — not scoped to this extension; data_collection=true, third_party_sharing=true.
• Free-webmail developer store Developer email mikecrittenden@gmail.com; no verified publisher badge; brand_mention.developer_domain=gmail.com.
• install_url_hijack crx onInstalled opens https://shortkeys.app/welcome (+2.0 Webstore).
• Geo-diverse JS hosts crx 5 countries (CA,DE,IN,SG,US) across 7 external hosts; geo_diversity +1.5 Network.
• is_featured_by_google=true store Featured badge applied; reduces Reputation by -2.0 but does not negate high-capability concern.
• rating 3.4 with no review red-flags store Below 4.5 threshold; no review_red_flags matched; no further penalty applied.

Permissions Breakdown

• downloads medium Can trigger file downloads to user's system.
• storage low Stores extension settings locally.
• tabs medium Can read tab URLs and metadata across all tabs.
• clipboardWrite medium Can write arbitrary content to clipboard.
• browsingData high Can delete browsing history, cookies, cache — destructive high-risk API.
• bookmarks medium Can read/write/delete user bookmarks.
• sessions medium Can access recently closed tabs and session data.
• management high Can disable/uninstall other extensions — significant lateral capability.
• debugger high Attaches Chrome debugger protocol; full page inspection and script injection.
• scripting high Injects scripts into pages; combined with <all_urls> is critical surface.
• notifications low Can display desktop notifications.
• activeTab low Scoped to user-activated tab; lower risk than broad host perms.
• userScripts high Allows execution of arbitrary user-supplied scripts via API — very high risk.
• *://*/* high Broad host permission covering all sites; amplifies every other HIGH permission.

Pillar Scores

Bookkeeping