Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Extension last updated 49 months ago (>36mo), fully stale/abandoned.
• Developer uses free Gmail address with no business identity; brand_mention flags StackOverflow impersonation.
• No CSP (MV3 strict default applies but no explicit policy); +2.0 network penalty for MV2-style absence not applied for MV3, but noted.
• Only 6 installs and no ratings — unverified, unaccountable micro-publisher.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; mentions 'stackoverflow', developer is not confirmed owner, email is gmail.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• maintenance_stale store Last updated May 2022; months_since_update=49 (>36mo) → maintenance pillar 10.0.
• free_webmail_developer store Developer email alexei.shamov@gmail.com; no business website; developer_domain gmail.com.
• no_csp manifest content_security_policy=null; MV3 so no +2.0 network penalty, but network base +0 with no external hosts.
• no_code_findings crx js_files_scanned=0, code_findings_raw=[], obfuscation_score=0.0 — no JS surface observable.
• very_low_installs store Only 6 installs, 0 ratings; micro-publisher with no accountability signals.
• content_scripts_scoped manifest content_scripts_matches restricted to stackoverflow.com question paths only; low capability.

Permissions Breakdown

• content_scripts(*://stackoverflow.com/*) low Scoped solely to stackoverflow.com, matching stated function of widening layout.

Pillar Scores

Bookkeeping