Top Risks

• Privacy policy admits unscoped 3rd-party data sharing and collection.
• Both uninstall and install URL hijacks redirect to third-party site.
• Broad host access (*://*/*) paired with free-webmail anonymous developer.
• Stale maintenance (11 months since update).
• jQuery 3.6.0 bundled without a Content Security Policy.

Evidence

• broad_host_access manifest content_scripts matches *://*/* allowing script injection on all websites.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to 3rd-party yowgames.com.
• install_url_hijack crx onInstalled opens 3rd-party yowgames.com URL.
• privacy_policy_unscoped api Policy fetched, admits data collection and 3rd-party sharing, but not scoped to extension.
• free_webmail_dev store Developer email dermanseven32@gmail.com, no verified business entity.
• stale_maintenance store Last updated 11 months ago (November 30, 2025).
• no_csp manifest manifest_version 3 but content_security_policy is null.

Permissions Breakdown

• storage low Local data persistence, low impact.
• content_scripts_matches:*://*/* high Broad host access to inject scripts on all sites.

Pillar Scores

Bookkeeping