Top Risks

• Broad host access (all URLs) via host_permissions and content_scripts despite narrow stated purpose.
• Privacy policy does not specify extension-scoped data collection practices.
• Use of new Function() constructor indicates potential for dynamic code execution.
• DOM-XSS sink (innerHTML assignment) detected in one library.
• Low user rating (2.7) despite high install count suggests quality or trust issues.

Evidence

• permissions crx http://*/* and https://*/* host permissions declared.
• content_scripts crx content_scripts_matches include http://*/* and https://*/* alongside specific origins.
• privacy_policy api Fetched policy lacks extension-specific scope (scope_extension: false).
• code_quality crx function_constructor found in 3 JS files.
• code_quality crx dom_sink_innerhtml_userctrl found in 1 JS file; CSP present.
• reputation store Rating 2.7 across unknown number of reviews.
• installs store Install count: 1,000,000.
• maintenance store Last updated: October 23, 2026 (0 months ago).

Permissions Breakdown

• storage low Standard local storage, low risk.
• unlimitedStorage low Allows unlimited local storage, low risk.
• activeTab low Limited to active tab on user action, low risk.
• notifications medium Can display notifications, medium risk with host access.
• scripting medium Can execute scripts in pages, medium risk.
• contextMenus low Adds right-click menu items, low risk.
• sidePanel low UI panel access, low risk.
• system.cpu low Read-only CPU info, low risk.
• offscreen low Background DOM access, low risk.
• gcm low Google Cloud Messaging, low risk.
• alarms low Scheduled tasks, low risk.
• identity low OAuth identity, no scopes specified, low risk.
• http://*/* high Broad host access to all HTTP sites, high risk.
• https://*/* high Broad host access to all HTTPS sites, high risk.

Pillar Scores

Bookkeeping