Top Risks

• Privacy policy is Google's generic account policy — does NOT scope to this extension or its data handling.
• Content scripts injected on all http/https URLs despite no declared host_permissions; broad reach.
• No CSP declared (MV3 mitigates somewhat, but adds no extra hardening).
• Recognized enterprise brand (CyberArk) but not verified publisher — reputation partially unanchored.
• 1M installs makes supply-chain compromise high-impact if extension is ever transferred or hijacked.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's policy, not CyberArk's extension policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• content_scripts_broad manifest content_scripts_matches includes http://*/* and https://*/* giving injection surface across all web pages.
• no_csp manifest content_security_policy is null; MV3 provides defaults but no explicit hardening.
• developer_domain_resolves api cyberark.com resolves, not throwaway, no bad-host or monetization hits — credible enterprise vendor.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts empty — clean code surface.
• no_cve_findings crx cve_findings_raw empty; no vulnerable bundled libraries detected.
• unverified_publisher store verified_publisher=false and is_featured_by_google=false despite CyberArk being a known enterprise security brand.
• install_scale store 1,000,000 installs; supply-chain compromise would have enterprise-wide blast radius.

Permissions Breakdown

• activeTab low Grants access to current tab only on user gesture; low blast radius.
• clipboardWrite medium Can write to clipboard; CyberArk PAM use-case matches stated function.
• offscreen low Creates offscreen document; typically used for clipboard ops in MV3.
• content_scripts http://*/* https://*/* medium Broad host content-script injection across all sites, though no host_permissions declared.

Pillar Scores

Bookkeeping