Top Risks

• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (v3.5 D → +10.0 privacy).
• Developer uses free Gmail address with no verified business identity, raising accountability concerns.
• DOM-XSS sink (innerHTML on user-controlled variable) in context.js with no CSP present.
• scripting permission over vk.com/vk.ru allows full page script injection on every VK session.
• Developer name 'vk.com/audio' implies affiliation with VK but is unverified; not flagged as impersonation by brand_mention.

Evidence

• privacy_policy_generic_google store Privacy URL points to myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• developer_email_free_webmail store petrapravdinawels@gmail.com — free webmail, no verified business domain; domain_age_ct not queried.
• dom_sink_innerhtml_userctrl crx context.js: innerHTML assigned from variable with no CSP guard — DOM-XSS risk.
• no_csp manifest content_security_policy is null (MV3 strict default applies, but csp_present=false confirms no explicit policy).
• scripting_with_host_permissions manifest scripting + https://vk.com/* + https://vk.ru/* — full script injection on VK domains.
• no_bad_hosts_no_monetization api threat_intel: bad_host_hits=[], monetization_hits=[], affiliate_hits=[] — no active exfil indicators.
• recently_updated store months_since_update=1, last_updated=July 13 2026 — maintenance risk minimal.
• operator_cluster_singleton api sibling_count=0; no cluster risk.

Permissions Breakdown

• scripting high Allows injecting JS into vk.com/vk.ru pages; combined with host perms gives full page control.
• https://vk.com/* medium Scoped host access to VK — matches stated function but enables full DOM read/write on VK.
• https://vk.ru/* medium Secondary VK domain; same risk surface as vk.com, scoped appropriately.

Pillar Scores

Bookkeeping