Top Risks

• Privacy policy is Google's generic corporate policy; does NOT scope data collection to this extension, admits 3rd-party sharing (+10.0 privacy).
• Content script on <all_urls> gives extension read access to every page the user visits.
• No CSP declared (MV3 default applies, but no explicit scoping of extension pages).
• Google Analytics telemetry endpoint contacted; policy doesn't explain what is sent.
• 3M installs amplify any future compromise or policy-drift impact.

Evidence

• content_scripts_all_urls manifest content_scripts_matches=["<all_urls>"] — script runs on every page visited.
• privacy_policy_generic store policies.google.com/privacy: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy per v3.5 rule D.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount (featured badge).
• recognized_org store developer_email @google.com + confirmed_owner=true; -2.0 reputation but CAPABILITY GATE: content_scripts <all_urls> is HIGH capability, caps discount.
• monetization_hit_telemetry api www.google-analytics.com in monetization_hits; telemetry-tier only → +1.0 webstore.
• no_cve_findings crx cve_findings_raw=[] — no vulnerable bundled libraries detected.
• no_code_findings crx code_findings_raw=[], obfuscation_score=0.0 — clean code scan.
• maintenance_recent store months_since_update=4 — within 3-6 month band → +1.5 maintenance.

Permissions Breakdown

• storage low Stores user preferences/history locally; no cross-site data risk.
• content_scripts:<all_urls> high Content script injected on all URLs; can read page content on every site visited.

Pillar Scores

Bookkeeping