Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Session Export Tool [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• cookies + <all_urls>: can silently read session cookies from any website and export them.
• clipboardWrite enables cookie/session data exfiltration to clipboard without user confirmation.
• Privacy policy is Google's generic policy — does not disclose what THIS extension collects.
• Free-webmail developer (gmail) with no verifiable business identity; unverifiable accountability.

Evidence

• cookies + <all_urls> manifest Extension declares cookies permission with <all_urls> host access — can exfiltrate any site session.
• generic privacy policy store Policy URL points to Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• free-webmail developer store Developer email vitaliyacloud@gmail.com; no verified business domain or publisher badge.
• small_install_high_perm api 41 installs with HIGH-tier permissions (cookies+<all_urls>) — install_perm_anomaly flagged.
• external IP-lookup hosts crx JS contacts api.ipify.org and ifconfig.me to retrieve user IP address — fingerprinting capability.
• no CSP (MV3) manifest csp_present=false; MV3 provides strict default but no explicit extension page CSP declared.
• apple.com host permission manifest Specific broad host permission for *.apple.com with no stated Apple-specific functionality.
• no verified publisher store verified_publisher=false, is_featured_by_google=false; no accountability signals present.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Session Export Tool [credential-theft] + malext.io malicious_extension_sentry; score 5.54 -> 8.04 (+2.5 cap 2.5).

Permissions Breakdown

• cookies high Can read all cookies across all URLs via <all_urls> host permission — high exfil potential.
• activeTab low Scoped to user-activated tab only; limited standalone risk.
• clipboardWrite medium Writes to clipboard; combined with cookies+<all_urls> enables silent session exfil.
• https://*.apple.com/* medium Specific high-value target host; narrow but notable.
• <all_urls> high Broad host access amplifies cookies permission — can harvest sessions from any site.

Pillar Scores

Bookkeeping