Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Amazon Global Price Checker + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy admits data collection and third-party sharing without scoping to this extension (saxsos.xyz generic policy).
• Amazon brand impersonation: developer is unverified gmail account with no confirmed ownership of amazon brand.
• Install URL hijack detected: onInstalled opens a third-party URL.
• Free-webmail developer (gmail) with no verified business identity or publisher badge.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer domain is gmail.com, confirmed_owner=false.
• privacy_policy_generic_admits_sharing api scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy classification.
• install_url_hijack crx install_url_hijack=true; onInstalled opens third-party URL target not disclosed.
• free_webmail_developer store Developer email ecomstal.official@gmail.com; no verified publisher badge; no business website.
• unverified_low_install store Only 8 installs, 0 ratings; very new/unproven extension from anonymous developer.
• external_js_host crx Contacts api.frankfurter.app for currency conversion; benign but adds network surface.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• privacy_policy_on_throwaway_domain api Policy hosted at saxsos.xyz — unrelated to extension function, no extension-scoped retention disclosure.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Amazon Global Price Checker + malext.io malicious_extension_sentry; score 4.56 -> 7.06 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Used to persist price comparison data locally; low risk.
• *://*.amazon.com/* (and 22 other amazon TLDs) medium Broad host access across all Amazon storefronts; justified for price-checker but enables read of all page content.

Pillar Scores

Bookkeeping