Top Risks

• Broad host_permissions (*://*/*) + content_scripts on all URLs gives full page-content access on every site.
• uninstall_url_hijack flag set; uninstall lifecycle event captured (target null but signal present).
• Privacy policy discloses third-party sharing with no data retention period specified.
• brand_mention.is_impersonation=true for 'reddit' while developer is unverified gmail account.
• small_install_high_perm anomaly: 478 installs with HIGH-tier permissions raises tail-attack-surface concern.

Evidence

• broad_host_access manifest host_permissions *://*/* + content_scripts <all_urls>; extension runs on every page the user visits.
• uninstall_url_hijack crx uninstall_url_hijack=true detected; target is null but lifecycle hook is present.
• brand_impersonation store brand_mention lists 'reddit' as impersonation; developer is gmail/unverified — no confirmed ownership.
• privacy_third_party_sharing api Privacy policy scope_extension=true but third_party_sharing=true and retention=false; incomplete disclosure.
• dom_xss_sinks crx 4 innerHTML-userctrl findings across content.js, options.js, popup.js, react-dom vendor; no CSP to mitigate.
• no_csp manifest csp_present=false on MV3; innerHTML sinks lack CSP mitigation raising DOM-XSS risk.
• small_install_high_perm store 478 installs with HIGH-tier permission (*://*/*); install_perm_anomaly.small_install_high_perm=true.
• featured_by_google store is_featured_by_google=true; partially mitigates reputation concerns but not impersonation or privacy gaps.

Permissions Breakdown

• storage low Stores user preferences locally; minimal risk.
• tabs medium Can read tab URLs; needed to find HN/Reddit links for current page.
• host_permissions: *://*/* high Broad host access on all URLs; content scripts inject into every page.
• content_scripts: <all_urls> high Runs JS on every page visited; significant reach even if stated function is narrow.

Pillar Scores

Bookkeeping