Top Risks

• Privacy policy is LinkedIn's corporate policy, not scoped to this extension; data_collection and third_party_sharing both true without extension-specific scope.
• install_url_hijack flag is true; onInstalled may open a third-party URL, though target is null.
• No CSP declared (MV3 default applies, but absence reduces defense-in-depth).
• 200K installs amplify any future compromise blast radius.
• Privacy policy scope_extension==false means data handling for the extension is not explicitly disclosed.

Evidence

• recognized_org store Developer is LinkedIn (linkedin.com); confirmed_owner=true, domain resolves, not throwaway.
• privacy_policy_generic api Policy fetched but scope_extension=false; data_collection=true, third_party_sharing=true → +10.0 privacy pillar (v3.5 rule D).
• install_url_hijack crx install_url_hijack=true; target is null so destination unknown. +2.0 webstore per hijack rule, minus recognized-org context.
• no_csp manifest content_security_policy=null; MV3 default CSP applies, no custom CSP hardening.
• narrow_host_permissions manifest Host access limited to https://www.linkedin.com/* only; matches stated notification function.
• clean_code_scan crx code_findings_raw empty; obfuscation_score=0.0; no CVEs detected.
• operator_cluster_clean api sibling_count=0; no related suspicious extensions under same fingerprint.
• install_count_medium store 200,000 installs: +1.0 webstore signal for reach; offset by clean threat intel.

Permissions Breakdown

• alarms low Schedules periodic tasks; no data access.
• storage low Stores local extension state; no cross-origin risk.
• https://www.linkedin.com/* low Scoped strictly to LinkedIn's own domain; matches stated function.

Pillar Scores

Bookkeeping