Top Risks

• Privacy policy is Google's own account policy — not scoped to this extension; admits broad data collection and 3rd-party sharing.
• Broad host_permissions (*://*/*) + content_scripts on <all_urls> give access to every page the user visits.
• Uninstall URL hijack and install URL hijack flags present — extension registers hooks on install/uninstall events.
• No developer name listed; missing 'Offered by' identity increases accountability risk.
• Verified/featured discounts apply but Google policy as privacy policy is structurally inadequate for extension data disclosure.

Evidence

• broad_host_access manifest host_permissions *://*/* + content_scripts <all_urls>: extension runs on every page.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy pillar (v3.5 rule D).
• uninstall_url_hijack crx uninstall_url_hijack=true; extension sets runtime hook on uninstall (target null but flag raised).
• install_url_hijack crx install_url_hijack=true; extension opens page on install event.
• no_developer_name store developer_name is empty string; 'Offered by' identity unverifiable despite verified_publisher=true.
• verified_and_featured store verified_publisher=true and is_featured_by_google=true; discounts applied to reputation pillar.
• csp_absent_mv3 manifest content_security_policy=null; MV3 has strict default so no v2 +2.0 network penalty applied.

Permissions Breakdown

• storage low Local data persistence; minimal risk on its own.
• activeTab medium Access to current tab content on user action; moderate scope.
• declarativeNetRequest medium Can intercept/block network requests; meaningful capability without blocking.
• *://*/* (host_permissions) high Broad host access across all URLs amplifies every other permission.
• <all_urls> (content_scripts) high Content script injected on every page; reads DOM on all sites.

Pillar Scores

Bookkeeping