Top Risks

• Privacy policy is Google's generic account policy — does not scope data collection to this extension at all.
• Developer uses free webmail (gmail) with no verified business identity.
• Content scripts run on all HTTP/HTTPS/file URLs giving broad DOM access across every site visited.
• No CSP declared (MV3 mitigates but no explicit lockdown).
• 3M installs amplifies blast radius if extension is ever compromised or sold.

Evidence

• privacy_policy_generic api Policy URL is myaccount.google.com/privacypolicy — scope_extension=false, collects data, shares with third parties; irrelevant to this extension.
• developer_free_webmail store Developer email igrigorik@gmail.com; no business domain; domain_age_ct not queried (free webmail).
• featured_by_google store is_featured_by_google=true; follows recommended practices badge present, partial reputation credit.
• broad_content_scripts manifest content_scripts_matches covers file:///* http://*/* https://*/* — runs on every page.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit lockdown declared.
• clean_code_scan crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts beyond github.com.
• no_bad_hosts_or_monetization api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits.
• high_install_count store 3,000,000 installs; large blast radius if ownership or code ever compromised.

Permissions Breakdown

• storage low Stores user speed preferences locally; no cross-site data risk.
• content_scripts: file:///* http://*/* https://*/* medium Broad content script injection on all sites; needed for video speed control but high reach.

Pillar Scores

Bookkeeping