Top Risks

• Privacy policy belongs to Mellowtel (bandwidth-sharing SDK), not developer — extension likely embeds bandwidth-sharing monetization infrastructure.
• Content scripts injected on all URLs combined with <all_urls> host permission gives full page read/write capability across every site.
• Free-webmail dev (gmail), no developer name, no business website — unverifiable identity.
• new Function() constructor in mellowtel.js enables dynamic code execution; no CSP to restrict it.
• Only 7 installs with high-tier permissions — tail-attack-surface anomaly flagged.

Evidence

• mellowtel_sdk_privacy_policy store Privacy policy URL is mellowtel.com — a paid bandwidth-sharing SDK. Extension likely monetizes user bandwidth without disclosure in listing.
• all_urls_content_scripts manifest content_scripts_matches: <all_urls> + host_permissions: <all_urls>; full read/write on every page.
• function_constructor_in_mellowtel_js crx new Function() in mellowtel.js allows dynamic code construction; bypasses static analysis.
• no_csp manifest content_security_policy is null; no script-src restrictions on MV3 extension pages.
• free_webmail_no_dev_name store Developer email toyomii.official@gmail.com; developer_name empty; no verifiable business identity.
• small_install_high_perm_anomaly api 7 installs + HIGH-tier permissions (all_urls + content_scripts) flags install_perm_anomaly.
• third_party_sharing_in_policy store Privacy policy admits third_party_sharing=true but scope_extension=true; Mellowtel shares bandwidth data with partners.
• cloudflare_external_hosts crx js_external_hosts: aim.cloudflare.com, speed.cloudflare.com — consistent with Mellowtel speed/latency measurement.

Permissions Breakdown

• storage low Local data persistence; low inherent risk.
• declarativeNetRequest medium Can modify/block network requests; moderate risk without full webRequest.
• <all_urls> (host_permissions) high Grants access to all sites; broad attack surface.
• content_scripts <all_urls> high Injects JS into every page; combined with <all_urls> host perm amplifies risk.

Pillar Scores

Bookkeeping