Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• eval(workerString) in Twitch userscript — dynamic eval of variable enables arbitrary code execution if workerString is attacker-controlled.
• cookies + <all_urls> + webRequest + management: maximal browser capability surface; compromise would expose all user sessions and other extensions.
• declarativeNetRequestWithHostAccess + scripting + <all_urls>: full request interception and page modification on every site visited.
• No CSP on MV3 extension with 12 external JS host endpoints and eval findings; network-sourced code could execute without sandboxing.

Evidence

• verified_publisher+featured store Verified publisher badge and featured by Google; reputation floor 2.0 applied.
• eval_user_input crx eval(workerString) in twitch-vaft-userscript-v2.js — direct eval of runtime variable.
• function_constructor crx new Function('return this') in options.js — dynamic code construction.
• csp_absent_mv3 manifest content_security_policy is null; no CSP on extension with external hosts and eval findings.
• uninstall_url_hijack crx uninstall_url_hijack=true; chrome.runtime.setUninstallURL() to 3rd-party destination.
• broad_permissions manifest cookies+<all_urls>+webRequest+scripting+management+declarativeNetRequestWithHostAccess all declared.
• external_hosts crx 12 external JS hosts including github.com, gql.twitch.tv, retail partner domains.
• privacy_policy api Policy fetched, scoped to extension, data_collection+retention+third_party_sharing all true; adequate.

Permissions Breakdown

• alarms low Schedules background tasks; minimal risk.
• cookies high Full cookie read/write across all sites paired with <all_urls>.
• tabs medium Access to tab URLs and metadata on all sites.
• storage low Local extension storage only.
• scripting high Programmatic script injection into any page via <all_urls>.
• webNavigation medium Observes navigation events across all sites.
• unlimitedStorage low Removes local storage quota; no direct privacy risk.
• declarativeNetRequestWithHostAccess high Can block/redirect network requests across all hosts.
• declarativeNetRequestFeedback low Read-only feedback on matched rules; low standalone risk.
• offscreen low Offscreen DOM for background processing; limited scope.
• webRequest high Observe all HTTP requests across all sites.
• management high Can enumerate/disable/uninstall other extensions.
• sidePanel low UI surface only; no data access on its own.
• <all_urls> high Broad host access amplifies every other high-risk permission.

Pillar Scores

Scoring History

Bookkeeping