Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Darktheme for google translate [click-fraud] (+2.0, capped).
• Uninstall URL hijack to inst.darkmode.site — classic monetization/tracking redirect shell pattern (+3.0 webstore).
• Install URL hijack to inst.darkmode.site — phoning home on install to third-party domain (+2.0 webstore).
• Privacy policy is Google's own generic policy — does not scope to this extension; admits data collection and 3rd-party sharing → +10.0 privacy.
• Brand impersonation: dev is unverified Gmail user citing Google brand without ownership confirmation (+2.0 reputation).

Evidence

• uninstall_url_hijack crx setUninstallURL → https://inst.darkmode.site/uninstall.html; third-party domain, monetization/tracking signal.
• install_url_hijack crx onInstalled opens https://inst.darkmode.site/install.html; third-party phone-home on install.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true; dev domain gmail.com, confirmed_owner=false, not verified publisher.
• free_webmail_developer store Developer email kohl.rainer1991@gmail.com; no business website; reputation floor ≥ 7.5 applied.
• dom_sink_innerhtml crx innerHTML sink in popup.100f6462.js; no CSP present → DOM-XSS risk elevated.
• js_external_hosts crx Extension contacts inst.darkmode.site and reactjs.org externally; 2 non-primary external domains.
• maintenance_stale store months_since_update=18; maintenance pillar +6.0 (12-24mo band).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Darktheme for google translate [click-fraud]; score 4.30 -> 6.30 (+2.0 cap 2.5).

Permissions Breakdown

• storage low Stores extension preferences locally; minimal risk.
• scripting medium Can inject scripts into matched pages (all Google Translate TLDs).
• content_scripts (translate.google.*/) low Scoped only to translate.google domains; matches stated function.

Pillar Scores

Bookkeeping