Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension; collects & shares data with third parties unaccountably.
• cookies + <all_urls> + scripting: can exfiltrate session cookies and inject code on every website the user visits.
• 5 innerHTML DOM-XSS sinks with no CSP — content injected on all pages is exploitable if remote data is attacker-influenced.
• Brand impersonation: 'Pinterest' brand used in name by unaffiliated gmail developer with no business domain.
• affiliate link via bit.ly and 12 diverse external JS hosts including Google Analytics contacted from extension with broad host access.

Evidence

• cookies+<all_urls>+scripting HIGH combo manifest cookies paired with <all_urls> and scripting on all URLs; ×1.2 amplifier applied.
• No CSP declared manifest content_security_policy is null on MV3 extension with broad content_scripts; DOM-XSS sinks fully exploitable.
• Brand impersonation store brand_mention.is_impersonation=true for 'pinterest'; developer is gmail-only, not verified publisher.
• Generic Google privacy policy store Policy is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• 5 innerHTML DOM-XSS sinks, no CSP crx dom_sink_innerhtml_userctrl in 5 files with csp_present=false triggers +2.0 FIX B per finding; capped.
• Affiliate hit: bit.ly crx threat_intel.affiliate_hits has 1 domain (bit.ly); +1.5 Webstore.
• 12 distinct external JS hosts crx js_external_hosts count=12; >3 distinct domains triggers +1.5 Network; geo-diversity 4 countries triggers +1.5 Network.
• Free-webmail developer, no business domain store jeunesserift@gmail.com; no verified publisher badge; Reputation floor ≥7.5 per rubric.

Permissions Breakdown

• tabs medium Can read tab URLs and titles across all open tabs.
• contextMenus low Adds right-click menu items; low direct risk.
• storage low Local extension data storage; low risk in isolation.
• cookies high Combined with <all_urls> host access — can read/write cookies on any domain including auth tokens.
• scripting high Can inject JS into any page via <all_urls>; broad code execution capability.
• <all_urls> high Full host access to all sites; broadest possible reach for cookies and scripting.
• *://*/* high Redundant broad host permission; same HIGH risk surface as <all_urls>.
• *://*.pinterest.com/ low Scoped to Pinterest domain; consistent with stated function.
• content_scripts http://*/* https://*/* high Content scripts injected on every page; combined with no CSP this is a major XSS surface.

Pillar Scores

Bookkeeping