Top Risks

• Privacy policy fetched but scope_extension==false with third_party_sharing==true: policy admits data sharing without scoping to this extension.
• Broad host permissions (http://*/*, https://*/*) + content_scripts on <all_urls> gives read/write access to every page visited.
• innerHTML DOM-XSS sink in content.js and main.js executing on all pages; CSP present but does not prevent DOM-based XSS.
• new Function() constructor in bundled OCR/PDF workers; mitigated by wasm-unsafe-eval CSP but raises dynamic-execution concern.
• Developer name absent; no verified publisher badge; react@16.13.1 bundled (version pre-dates React security fixes).

Evidence

• broad_host_permissions manifest host_permissions include http://*/*, https://*/*, file:///* plus content_scripts on <all_urls>.
• privacy_policy_scope_mismatch crx Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• dom_xss_sink crx innerHTML from variable in content.js and main.js; csp_present=true so +0.5 each (no escalation to +2.0).
• function_constructor crx new Function() in tesseract-worker, pdf.worker, pdfViewer.js — dynamic code construction in bundled libs.
• no_developer_name store developer_name is empty string; email hey@highlighty.app on own domain but no verified publisher badge.
• featured_by_google store is_featured_by_google=true; applies -2.0 Reputation discount (Follows recommended practices).
• react_16_13_1_bundled crx react@16.13.1 detected via license sidecar; pre-18 release, no CVEs found in cve_findings_raw.
• external_hosts crx js_external_hosts: reactjs.org (docs/CDN ref), us-central1-highlighty-firebase.cloudfunctions.net (backend).

Permissions Breakdown

• storage low Local data persistence; expected for saving highlights.
• unlimitedStorage low Extended quota; reasonable for OCR/PDF highlight storage.
• activeTab low Temporary access to current tab only; narrow scope.
• http://*/* high Broad host access across all HTTP sites via host_permissions.
• https://*/* high Broad host access across all HTTPS sites via host_permissions.
• file:///* medium Access to local filesystem pages; unusual but plausible for PDF highlight.
• content_scripts <all_urls> high Content script injected on every page; broad reach for a highlight tool.

Pillar Scores

Bookkeeping