Top Risks

• Broad host access (*://*/*) with scripting permission allows reading/modifying content on every page visited.
• AI/writing extension processes page text and sends it to linguix.com; third-party sharing admitted in privacy policy.
• Privacy policy lacks data retention disclosure despite confirming data collection and third-party sharing.
• Two DOM-XSS innerHTML sinks in content/popup scripts; no eval or remote loading, but CSP present mitigates partially.
• No developer name listed in store; developer identity relies solely on hi@linguix.com and linguix.com domain.

Evidence

• broad_host_access manifest host_permissions: *://*/*; content_scripts also match <all_urls>. Full read/write on every site.
• ai_page_content_processing store AI writing/grammar assistant category; sends user text to linguix.com backend.
• privacy_policy_gaps api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• dom_xss_sinks crx Two innerHTML assignments from variables in ext-content/main.js and ext-popup/main.js.
• uninstall_url_hijack crx uninstall_url_hijack=true; target not captured but runtime.setUninstallURL() called.
• no_developer_name store developer_name is empty string; only hi@linguix.com and linguix.com domain identify the publisher.
• featured_by_google store is_featured_by_google=true; provides partial trust signal, not verified publisher.
• cve_clean crx cve_findings_raw empty; no known-bad hosts; no obfuscation (score=0.0).

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; moderate privacy exposure.
• storage low Local data persistence; low risk in isolation.
• contextMenus low Adds right-click menu items; minimal risk.
• clipboardWrite medium Can overwrite clipboard contents; moderate abuse potential.
• clipboardRead medium Can read clipboard; sensitive data exposure risk.
• scripting high Dynamic script injection into pages; high capability when paired with <all_urls>.
• *://*/* high Broad host access across all sites; core reach for grammar/AI tool but high surface area.

Pillar Scores

Scoring History

Bookkeeping