Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; collects and shares data with third parties.
• Brand impersonation: names ChatGPT, Gemini, Claude in title without confirmed ownership, not verified publisher for those brands.
• Install-URL hijack: onInstalled opens chatmemo.ai/welcome, redirecting users to developer's site.
• No CSP declared (MV3 strict-default mitigates, but innerHTML sinks and new Function() in jszip raise XSS risk from AI page content.
• <all_urls> content scripts extend beyond the stated AI-chat platforms, creating broad page-access surface.

Evidence

• privacy_policy_generic store Privacy URL points to Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy score.
• brand_impersonation store brand_mention.is_impersonation=true; title references ChatGPT/Gemini/Claude; confirmed_owner=false; verified_publisher=true but not for those brands.
• install_url_hijack crx install_url_hijack=true; target=https://chatmemo.ai/welcome — opens dev site on every install.
• dom_xss_sinks crx Two innerHTML-from-variable sinks in popup.js and content_common.js; no CSP; could render attacker-controlled AI chat content.
• function_constructor_in_jszip crx new Function() in lib/jszip.min.js; in bundled library context, elevated risk with no CSP.
• analytics_endpoint crx chatmemo-analytics.kylis.workers.dev in js_external_hosts; Cloudflare Worker analytics endpoint not documented in privacy policy.
• host_permissions_all_urls manifest <all_urls> host permission broader than the ~10 AI-chat domains listed in content_scripts_matches.
• developer_name_empty store developer_name is empty string; no 'Offered by' identity despite verified_publisher=true.

Permissions Breakdown

• storage low Needed to persist saved chat data locally.
• tabs medium Can read tab URLs and titles across all open tabs.
• downloads medium Can trigger file downloads; export function but also potential for abuse.
• alarms low Background scheduling; low standalone risk.
• <all_urls> (host_permissions) high Content scripts on <all_urls> gives read/write access to all pages, broader than AI-chat sites.

Pillar Scores

Bookkeeping