Top Risks

• Uninstall URL hijacked to www.saxsos.xyz — third-party exfil/tracking on removal.
• Privacy policy admits data collection and third-party sharing without scoping to this extension — triggers +10 privacy.
• Free-webmail Gmail developer with no verified business identity; domain_age_ct not queried.
• Extension JS contacts www.saxsos.xyz (same as uninstall URL) — unexplained external host.
• Geo-diversity: JS hosts span 4 countries (CA, RU, SG, US) outside expected category norms.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://www.saxsos.xyz/p/sorry.html; unexplained third-party domain.
• privacy_policy_generic_with_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy (v3.5 D).
• free_webmail_developer store Developer email ecomstal.official@gmail.com; not verified publisher, not featured.
• js_external_host_suspicious crx www.saxsos.xyz listed in js_external_hosts — same domain as uninstall URL, no stated purpose.
• geo_diversity api JS hosts in CA, RU, SG, US (4 countries) for a PriceTracker — +1.5 network.
• dom_sink_innerhtml crx innerHTML sink in content.js; no CSP present → elevated DOM-XSS risk (+2.0 code quality).
• install_count_very_low store Only 9 installs; extension is effectively unvetted by real users.
• no_csp manifest content_security_policy is null on MV3 extension with innerHTML sink — no script-src hardening.

Permissions Breakdown

• storage low Local key-value storage; no cross-origin data exposure.
• *://*.aliexpress.com/* medium Scoped host access matches stated price-tracking function; limited to AliExpress domains.
• *://*.aliexpress.ru/* medium Same as above — regional AliExpress domain.
• *://*.aliexpress.us/* medium Same as above — regional AliExpress domain.
• *://*.aliexpress.br/* medium Same as above — regional AliExpress domain.
• *://*.aliexpress.pl/* medium Same as above — regional AliExpress domain.

Pillar Scores

Bookkeeping