Top Risks

• new Function() on storage-sourced value in background.js enables remote code execution if storage is poisoned.
• eval() in twitch_utils.js on variable input; no CSP to mitigate.
• innerHTML sinks in popup.js and share.js with user-controlled data; DOM-XSS risk without CSP.
• Brand impersonation: Spotify mentioned in name/description but developer is unaffiliated (confirmed_owner=false).
• 12 external JS hosts contacted (CDN, analytics, Sentry, GitHub pages) with broad *://*/* host permission and no CSP.

Evidence

• function_constructor_storage_newvalue crx background.js: new Function(changes.injectnow.newValue) — executes arbitrary code from storage changes.
• eval_user_input crx twitch_utils.js: eval(workerString) — direct eval of variable, no CSP present.
• no_csp manifest content_security_policy is null; MV3 default applies but code evals are not blocked by it.
• brand_impersonation store brand_mention.is_impersonation=true for Spotify; confirmed_owner=false; verified_publisher=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; uninstall_url_target null but flag set by scanner.
• 12_external_hosts crx JS contacts blockify.b-cdn.net, insights.getblockify.com, sentry.getblockify.com, sweetalert2.github.io and 8 others.
• host_geo_diversity api JS hosts span 4 countries (CA, IN, NL, US); elevated for Adblock category.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discounts applied but capped per v3.5(E) due to no domain-age data.

Permissions Breakdown

• declarativeNetRequest medium Core ad-blocking capability; matches stated function.
• declarativeNetRequestFeedback medium Reads blocked-request logs; moderate info exposure.
• scripting high Programmatic script injection into pages; broad with *://*/*HostPermission.
• storage low Local state storage; standard.
• background low Persistent service worker; standard for MV3 adblockers.
• activeTab low Scoped to user-invoked tab; low risk.
• webNavigation medium Observes full navigation events across all tabs.
• tabs medium Access to tab URLs and metadata; moderate.
• alarms low Scheduling only; negligible risk.
• *://*/* (host_permission) high Broad host access; scripting+all_urls combo is high capability. Justified-broad discount applied for Adblock category.

Pillar Scores

Bookkeeping