Top Risks

• Brand name 'Google' in extension title with no verified ownership — impersonation risk.
• No CSP declared (MV3 default applies but no explicit policy); innerHTML sink in content.js raises DOM-XSS concern.
• Privacy policy scoped to extension but omits data retention and mentions third-party sharing without detail.
• Developer name field empty; identity relies solely on email domain wemakegood.org.
• Very low install count (65) limits blast radius but also limits community vetting.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'Google' in title but confirmed_owner=false and not verified publisher.
• dom_sink_innerhtml crx content.js assigns innerHTML from variable 'safeHTML'; no CSP to mitigate XSS if sanitisation bypassed.
• no_csp manifest content_security_policy is null; MV3 strict default applies but explicit policy absent.
• privacy_policy_gaps store Policy fetched, scope_extension=true, data_collection=false, but retention=false and third_party_sharing=true.
• developer_identity store developer_name empty; email chris.frazier@wemakegood.org; domain resolves, not throwaway.
• host_permissions_narrow manifest Hosts limited to drive.google.com and studio.workspace.google.com — matches stated markdown-preview function.
• cve_findings crx cve_findings_raw empty; no known vulnerable libraries detected.
• maintenance store last_updated May 2026; months_since_update=1 — actively maintained.

Permissions Breakdown

• activeTab low Grants access only to the currently active tab on user action.
• storage low Local extension storage; no cross-site data exposure.
• webNavigation medium Can observe navigation events; scoped to declared host permissions.
• https://drive.google.com/* medium Host permission to inject into Google Drive; narrow and matches stated function.
• https://studio.workspace.google.com/* medium Host permission for Workspace Studio; narrow and matches stated function.

Pillar Scores

Bookkeeping