Top Risks

• No CSP + new Function() across 4 files + innerHTML sink elevates XSS/code-injection risk significantly.
• webRequest + scripting + <all_urls> content scripts grants full read/write capability on every visited page.
• Gmail dev email with no verified business domain; identity accountability is weak.
• Privacy policy confirms data collection and third-party sharing but omits retention details.
• ip-api.com contact exposes user IP geolocation to a third-party outside the core download function.

Evidence

• no_csp crx content_security_policy is null (MV3 but no explicit CSP); amplifies function_constructor and innerHTML findings.
• function_constructor_multiple crx new Function() found in offscreen.js, policy.js, player.js, popup.js — 4 distinct files.
• broad_host_scripting manifest host_permissions <all_urls> + scripting + webRequest + content_scripts on <all_urls>.
• gmail_dev_email store developer_email=veevee.downloader@gmail.com; no verified business domain; developer_name empty.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• ip_api_contact crx Extension contacts ip-api.com (IP geolocation service) — not required for video downloading.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discounts applied but capped due to gmail email.
• monetization_telemetry_only crx Only google-analytics.com in monetization_hits; telemetry-tier, no affiliate or bad hosts.

Permissions Breakdown

• tabs medium Access to tab URLs and metadata; medium risk on its own.
• storage low Local settings persistence; low risk.
• unlimitedStorage low Allows large local storage; low incremental risk.
• offscreen low Off-screen document for background processing; low risk alone.
• scripting high Can inject scripts into any page given <all_urls> host access.
• webRequest high Can observe all network requests across all sites.
• notifications low Desktop notifications; low risk.
• downloads medium Can initiate file downloads; appropriate for a downloader tool.
• sidePanel low Adds a side panel UI; low risk.
• <all_urls> (host_permissions) high Grants access to all websites; broad surface paired with scripting and webRequest.
• <all_urls> (content_scripts) high Content scripts injected on every page; high reach for a download tool.

Pillar Scores

Scoring History

Bookkeeping