Top Risks

• Extension last updated 40 months ago — zombie-stale, unpatched if vulns emerge.
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and 3rd-party sharing.
• Free webmail dev (gmail) with no verified business entity or domain.
• DOM-XSS sink (innerHTML with user-controlled variable) in popup.js with no CSP.
• No content security policy on MV3; innerHTML sink is unmitigated.

Evidence

• zombie_stale store Last updated Feb 2023; 40 months ago — maintenance score maxed at 10.0.
• privacy_policy_generic store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) — D clause applies: +10.0.
• free_webmail_dev manifest Developer email autotabgroups@gmail.com; no business domain; +1.5 reputation.
• dom_xss_sink_no_csp crx dom_sink_innerhtml_userctrl in popup.js; csp_present=false → FIX B applies: +2.0 code quality.
• no_csp_mv3 manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• is_featured_by_google store Extension carries Featured badge; -2.0 reputation discount applied.
• no_bad_hosts_no_cve crx bad_host_hits=[], cve_findings_raw=[], affiliate_hits=[], monetization_hits=[] — clean threat intel.
• operator_cluster_clean api sibling_count=0; no cluster risk.

Permissions Breakdown

• tabs medium Can read tab URLs/titles; needed for tab management.
• tabGroups low Manages tab groups; low risk, matches stated function.
• storage low Local extension storage; standard, no exfil surface.

Pillar Scores

Bookkeeping