Top Risks

• Generic Google privacy policy admits collection and third-party sharing without extension scope.
• Unverified developer using free Gmail address.
• Install-time redirect to an unspecified third-party URL.
• Multiple unsanitized innerHTML DOM-XSS sinks across log rendering code.
• Small install base combined with cookie access to Salesforce sessions.

Evidence

• privacy_policy_generic api Policy is Google's generic statement; scope_extension=false with data_collection and third_party_sharing true.
• developer_identity store Developer uses free Gmail; no verified publisher badge.
• install_url_hijack crx onInstalled opens third-party URL.
• code_dom_sink crx 9 innerHTML assignments from variables in log/Apex rendering modules.
• install_perm_anomaly store 676 installs with high-tier cookie permission.
• permissions_scope manifest cookies + scripting scoped to Salesforce domains; justifies some breadth.
• threat_intel api No bad hosts, affiliate, or monetization signals; sibling count 0.
• cve_scan api cve_findings_raw empty; no vulnerable libraries flagged.

Permissions Breakdown

• cookies high Can read auth cookies on scoped Salesforce hosts; high value for session theft.
• scripting medium Programmatic injection on Salesforce domains.
• identity low No OAuth scopes declared; low risk as configured.
• storage low Local extension storage only.
• unlimitedStorage low Expands local storage quota; minor concern.
• alarms low Background scheduling; low impact.
• host:https://*.salesforce.com/* medium Host access scoped to primary Salesforce domain.
• host:https://*.force.com/* medium Host access to Salesforce Force.com sites.
• host:https://*.cloudforce.com/* medium Host access to Cloudforce domains.
• host:https://*.salesforce.mil/* medium Host access to Salesforce government cloud.
• host:https://*.cloudforce.mil/* medium Host access to Cloudforce government cloud.
• host:https://*.sfcrmproducts.cn/* medium Host access to Salesforce China domain.
• host:https://*.salesforce-setup.com/* medium Host access to Salesforce setup domain.

Pillar Scores

Bookkeeping