Top Risks

• debugger permission allows full DevTools protocol access — can intercept requests, read page content, and inject scripts on any attached tab.
• Privacy policy is Google's generic account policy; not scoped to this extension, admits data collection and third-party sharing (→ +10 privacy score).
• No developer identity: no name, no email, no verified publisher — unaccountable operator.
• DOM-XSS sinks (innerHTML) in popup and content script with no CSP; elevated XSS risk if data from Naver pages is unsanitised.
• Supabase host permission enables exfiltration of scraped Naver blog content to a third-party backend.

Evidence

• debugger_attach in background.js crx chrome.debugger.attach called at runtime; grants full CDP access to any attached tab regardless of host_permissions.
• Generic Google privacy policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; data_collection=true, third_party_sharing=true.
• No developer identity store developer_name, developer_email, and developer_domain_info all null/missing; operator is unverifiable.
• dom_sink_innerhtml_userctrl × 2 + no CSP crx innerHTML used in popup and naver content-script; csp_present=false raises DOM-XSS risk.
• Supabase host permission manifest https://*.supabase.co/* allows extension to POST scraped content to a third-party BaaS backend.
• 40+ Korean news/media host permissions manifest Broad read/modify access across major Korean news outlets beyond stated Naver Blog function.
• No install/rating/update data store Listing metadata entirely missing; blast radius and recency cannot be assessed.
• operator_cluster sibling_count=0 api No sibling extensions under same fingerprint; isolated operator cluster.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• debugger high Full Chrome DevTools protocol access; can intercept all page traffic and scripts.
• downloads medium Can initiate and manage file downloads.
• https://*.supabase.co/* medium Backend-as-a-service endpoint; data may be exfiltrated to Supabase.
• https://search.naver.com/* (and ~40 Korean news/media hosts) medium Broad access to Korean news/media sites; content-script on blog.naver.com enables DOM manipulation.

Pillar Scores

Bookkeeping