Top Risks

• Content scripts injected on <all_urls> with no CSP — broad reach across every site visited.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension.
• Extension is 26 months stale (zombie risk: future compromise or silent capability change).
• Dynamic script creation and Function constructor in editor.js raise code-execution concern.
• Uninstall URL hijack flag set; post-removal redirect to unknown third party.

Evidence

• host_permissions <all_urls> + content_scripts <all_urls> manifest Extension injects content scripts on every URL; scripting permission amplifies reach.
• no CSP (csp_present=false) crx MV3 with no explicit CSP; dynamic script creation finding is higher risk without CSP boundary.
• privacy policy: data_collection=true, third_party_sharing=true, scope_extension=false api Policy on GitHub admits collection and sharing but does not scope to Auto Highlight → D-clause +10.0.
• months_since_update=26 store Last updated April 2024; 26 months stale maps to +8.5 maintenance score.
• uninstall_url_hijack=true crx chrome.runtime.setUninstallURL() redirects user on removal; target URL not disclosed.
• code_findings: function_constructor + script_src_dynamic crx new Function() and dynamic <script> in editor.js — webpack runtime pattern but no CSP to constrain it.
• verified_publisher=true + is_featured_by_google=true store Verified publisher and featured; reputation discounts applied but capped per v3.5E (monetization check clean).
• developer_name empty, email admin@FastAddons.com store No 'Offered by' display name; domain resolves and not throwaway, partially mitigated by verified badge.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Stores extension settings locally; low risk.
• scripting medium Executes scripts in pages; elevated when paired with <all_urls>.
• alarms low Schedules background tasks; low risk on its own.
• activeTab low Access current tab on user gesture; scoped and low risk.
• <all_urls> (host_permission) high Content scripts injected on every site; broad reach amplifies scripting risk.

Pillar Scores

Bookkeeping