Top Risks

• Privacy policy fetched but scope_extension==false and data_collection==true: does not scope collection to this extension specifically.
• declarativeNetRequestWithHostAccess on mail.google.com grants ability to intercept/redirect Gmail network traffic.
• Two S3 buckets in host_permissions for attachment/file tracking create opaque outbound data paths.
• innerHTML DOM-XSS sink in dashboard bundle; no CSP eval protection but csp_present mitigates somewhat.
• Missing developer_name in store listing reduces accountability despite corporate email domain.

Evidence

• privacy_policy_scope_missing api Policy fetched; data_collection=true, scope_extension=false, third_party_silence=true → Privacy +9.0 +1.0=10.0 capped.
• declarativeNetRequestWithHostAccess manifest HIGH-tier permission paired with mail.google.com host access; core email-tracker function but broad capability.
• dom_sink_innerhtml_userctrl crx dashboard.bundle.js: innerHTML assigned from variable; CSP present (self-only) limits but does not eliminate XSS risk.
• is_featured_by_google store Featured badge present; -2.0 reputation discount applied.
• s3_host_permissions manifest Two AWS S3 buckets (mrt-attachments-prod, mt-file-tracking-temp) in host_permissions for attachment/file tracking.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• install_count_3M store 3,000,000 installs → +1.0+1.0+0.5 webstore reach; rating 4.4 with no red-flag reviews.
• no_cve_findings crx cve_findings_raw empty; no bundled library CVEs detected.

CVE Exposures (2)

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• declarativeNetRequestWithHostAccess high HIGH-tier: can block/redirect network requests on host-permitted URLs including mail.google.com.
• notifications low Can show desktop notifications; low risk in isolation.
• *://*.mailtrack.io/* medium Dev-owned tracking domain; scoped host permission.
• https://mail.google.com/* high Full access to Gmail; core function but highest-value data surface.
• *://*.mailsuite.com/* medium Dev-owned domain; scoped to own infrastructure.
• https://api.rollbar.com/* low Error telemetry endpoint; known legitimate service.
• https://http-intake.logs.datadoghq.eu/* low Logging/observability endpoint; known legitimate service.
• https://mrt-attachments-prod.s3.eu-west-1.amazonaws.com/* medium S3 bucket for attachment tracking; dev-controlled but opaque data flow.
• https://mt-file-tracking-temp.s3.eu-west-1.amazonaws.com/* medium Second S3 bucket for file tracking; dev-controlled but increases data exfil surface.

Pillar Scores

Scoring History

Bookkeeping