Top Risks

• Content script runs on <all_urls> — full page read/write on every site visited.
• Last updated 48 months ago; abandoned extension with no security patches expected.
• Privacy policy is generic Google account policy — does not scope to this extension at all.
• Brand impersonation: GitHub mentioned in name/description by unverified gmail developer.
• innerHTML sink in content.js with no CSP — DOM-XSS risk on every page.

Evidence

• content_scripts_all_urls manifest content_scripts_matches=["<all_urls>"] gives code execution on every origin visited.
• no_csp crx content_security_policy is null; no XSS mitigations in place for MV3 extension.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in content.js; no CSP present amplifies risk.
• stale_extension store Last updated June 2022 — 48 months since update; effectively abandoned.
• generic_privacy_policy store Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'github'; developer is unverified gmail user.
• install_url_hijack crx install_url_hijack=true; extension opens URL on install (target null, suspicious pattern).
• free_webmail_developer store Developer email galadiya41@gmail.com with no verified business domain.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low direct data access risk.
• content_scripts:<all_urls> high Script injected into every page; broadest possible content reach without explicit host_permissions.

Pillar Scores

Bookkeeping