Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy scoped to site, not extension; admits 3rd-party sharing without extension detail
• HIGH-impact perms: webRequest, proxy, cookies, nativeMessaging with <all_urls>
• Verified publisher discount capped due to monetization-adjacent signals
• 21M installs with rating 3.9 suggests user friction or quality concerns

Evidence

• verified_publisher store Web Store VERIFIED PUBLISHER badge present
• privacy_policy_scope crx Privacy policy fetched but scope_extension=false, data_collection=false, third_party_sharing=true
• high_risk_permissions manifest webRequest, proxy, cookies, nativeMessaging, management with <all_urls>
• native_messaging_unrecognized crx nativeMessaging with publisher_recognized=false
• install_base store 21,000,000 installs with rating 3.9
• no_csp crx content_security_policy null, csp_present=false
• no_code_findings crx code_findings_raw empty, obfuscation_score 0.0
• no_cves crx cve_findings_raw empty

Permissions Breakdown

• scripting high Scripting + <all_urls> allows arbitrary JS injection
• tabs medium Tab access for download interception
• cookies high Cookie access on all URLs
• contextMenus low Context menu entries
• webNavigation medium Navigation monitoring
• webRequest high Network request inspection/modification
• declarativeNetRequest medium Request blocking/redirect capability
• downloads medium Download management - core function
• downloads.shelf medium Download shelf control
• downloads.ui medium Download UI control
• management high Can enumerate/manage other extensions
• storage low Local storage
• proxy high Proxy configuration control
• nativeMessaging high Native app communication - IDM companion required

Pillar Scores

Bookkeeping