Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Consensus - Reddit Comment Summarizer [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — scores maximum privacy risk.
• Brand impersonation: uses 'Reddit' branding, developer domain (status77.com) is not affiliated with Reddit.
• Install-URL hijack detected: onInstalled opens third-party URL, a monetization/tracking signal.
• AI extension sends Reddit comment content to developer-controlled backend (aiconnect.chromiumextensions.com) with opaque data handling.

Evidence

• privacy_policy_admits_collection_and_sharing_unscoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D: +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for 'reddit'; developer domain status77.com not confirmed owner → +2.0 reputation.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens third-party URL → +2.0 webstore.
• no_developer_name store developer_name is empty → +1.0 reputation.
• ai_extension_page_content manifest AI summarizer with host_permissions on Reddit and outbound to aiconnect.chromiumextensions.com → +2.5 webstore.
• no_csp manifest content_security_policy=null on MV3; MV3 has strict default so no v2 +2.0 penalty, but no CSP flag noted.
• maintenance_6_to_12_months store months_since_update=12; falls in 6-12 month bucket → +3.5 maintenance.
• no_verified_publisher_no_featured store verified_publisher=false, is_featured_by_google=false; no trust discounts available.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Consensus - Reddit Comment Summarizer [divergent] + malext.io malicious_extension_sentry; score 5.08 -> 7.58 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local extension state; no cross-origin data exposure.
• https://www.reddit.com/* medium Host access to read Reddit page content; matches stated summarizer function.
• https://old.reddit.com/* medium Host access to old Reddit; matches stated summarizer function.
• https://reddit.com/* medium Host access to reddit.com; matches stated summarizer function.
• https://aiconnect.chromiumextensions.com/* medium Proprietary AI backend endpoint; content sent here is outside user control.

Pillar Scores

Bookkeeping