Top Risks

• tabCapture can record browser audio; misuse post-compromise could be invasive.
• Privacy policy discloses third-party sharing but scope applies to whole platform not extension-specific.
• 6M installs = large blast radius if extension were ever compromised or sold.
• months_since_update = 12 months; approaching stale threshold.
• No developer_name displayed in listing; relies on email identity only.

Evidence

• verified_publisher store Extension carries verified publisher badge; domain shazam.com resolves and is non-throwaway.
• featured_by_google store Marked as featured / follows recommended practices.
• permissions_minimal manifest Only tabCapture, storage, unlimitedStorage declared; no broad host permissions.
• csp_present_mv3 manifest CSP restricts script-src to 'self' and wasm-unsafe-eval; MV3 strict default applies.
• no_code_findings crx code_findings_raw empty; obfuscation_score 0.0; no exfil or eval signals.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.
• privacy_policy_classification api Policy fetched, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• maintenance_borderline store Last updated June 2025; months_since_update=12, triggering +3.5 stale penalty.

Permissions Breakdown

• tabCapture medium Captures audio/video from active tab; core to song-identification function.
• storage low Standard local key-value storage; minimal risk.
• unlimitedStorage low Allows large local data; no direct privacy risk but can impact disk.

Pillar Scores

Bookkeeping