Top Risks

• Broad host_permissions (http://*/*, https://*/*) plus content_scripts on all pages give full page-read capability.
• No CSP declared (MV3 default applies, but no explicit policy) combined with innerHTML sinks raises DOM-XSS risk.
• Privacy policy is generic Google corporate policy, not scoped to this extension's data practices.
• External JS hosts include non-Google domains (eddieantonio.ca, www.altlab.dev, github.com) — supply-chain surface.
• No 'Offered by' display name; developer_name is empty despite google.com email.

Evidence

• broad_host_permissions manifest host_permissions and content_scripts_matches both cover http://*/* and https://*/* — full site reach.
• dom_xss_sink crx innerHTML assigned from variable in chext_options.js and chext_popup.js; no CSP to mitigate.
• external_js_hosts crx JS contacts eddieantonio.ca, www.altlab.dev, github.com in addition to google.com/gstatic.com.
• privacy_policy_generic store Policy URL is generic google.com/policies/privacy; scope_extension=false, data_collection=false.
• google_developer store Email cloud-input-team@google.com + brand_mention confirmed_owner=true; not verified_publisher badge.
• is_featured_by_google store Extension carries is_featured_by_google=true, providing moderate trust signal.
• no_cve_findings crx cve_findings_raw is empty; no vulnerable bundled libraries detected.
• recently_updated store Last updated April 17, 2026; months_since_update=2 — actively maintained.

Permissions Breakdown

• offscreen low Allows offscreen document creation; limited blast radius.
• tabs medium Can read tab URLs and metadata; moderate info disclosure.
• storage low Local data persistence; standard for input-method tools.
• scripting medium Can inject scripts into pages; elevated with broad host access.
• http://*/* high Broad host permission enabling content script on all HTTP pages.
• https://*/* high Broad host permission enabling content script on all HTTPS pages.

Pillar Scores

Bookkeeping