Top Risks

• MANAGEMENT PERMISSION: extension can enumerate and disable other installed extensions (incl. security and privacy tools).
• management permission allows disabling/uninstalling other extensions — high-impact capability.
• history permission grants read access to full browsing history.
• No CSP declared (MV3 default enforced, but +2.0 network signal applied for MV2-style posture check — MV3 mitigates).
• Uninstall URL hijack flag set; target is null so actual redirect unconfirmed but warrants note.

Evidence

• management_permission manifest management declared — can enumerate and disable/uninstall other installed extensions.
• history_permission manifest history declared — full browsing history read/delete access.
• no_csp manifest content_security_policy is null; MV3 strict default applies, limiting remote code execution risk.
• uninstall_url_hijack store uninstall_url_hijack == true but target is null; actual redirect destination unverifiable.
• featured_by_google store is_featured_by_google == true; follows recommended practices signal reduces reputation risk.
• privacy_policy store Policy hosted on GitHub, fetched OK; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• clean_code_scan crx 0 code findings, obfuscation_score=0.0, no external JS hosts, no CVEs detected.
• threat_intel_clean api No bad_host_hits, affiliate_hits, or monetization_hits; developer domain resolves, not throwaway.

Permissions Breakdown

• management high Can enumerate, enable, disable, or uninstall other extensions — significant capability.
• tabs medium Access to tab URLs, titles, and navigation; core to stated tab-management function.
• history medium Read/delete full browsing history; elevated privacy risk.
• storage low Local data persistence only; standard for settings/state.
• tabGroups low Manages tab group metadata; low standalone risk, fits stated function.

Pillar Scores

Bookkeeping