Top Risks

• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — maps to worst-case privacy score.
• Broad host permissions (http://*/* + https://*/* + content_scripts <all_urls>) allow reading/modifying every page the user visits.
• No CSP declared; dom_sink_innerhtml_userctrl in content script with broad host access elevates DOM-XSS risk.
• new Function() constructor in jscolor.js enables dynamic code execution.
• 12 distinct external JS hosts contacted including coinbase.com and odvarko.cz — wide network footprint for a translation tool.

Evidence

• privacy_policy_generic_admits_sharing store Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy score +10.0 per v3.5(D).
• broad_host_permissions manifest host_permissions=[http://*/*, https://*/*] + content_scripts on <all_urls>; TranslationTool discount applied (-1.5).
• no_csp crx content_security_policy is null; MV3 default strict, but dom_sink_innerhtml_userctrl elevates risk under FIX B.
• dom_sink_innerhtml_userctrl crx translator.js assigns translation response to innerHTML — DOM-XSS sink; csp_present=false triggers +2.0 code quality.
• function_constructor crx jscolor.js uses new Function() for dynamic code execution (+2.5 code quality).
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reputation discounts applied, floor at 2.0.
• external_hosts_diverse crx 12 external hosts incl. commerce.coinbase.com, odvarko.cz; >3 distinct registrable domains (+1.5 network).
• no_cve_findings crx cve_findings_raw is empty; CVE pillar = 0.0.

Permissions Breakdown

• scripting medium Can inject JS into pages; paired with <all_urls> host access raises capability significantly.
• storage low Local settings persistence; low standalone risk.
• contextMenus low Adds right-click menu items; standard for translation tools.
• tabs medium Can read tab URLs and metadata across all open tabs.
• http://*/* high Broad host access to all HTTP sites; content scripts run on <all_urls>.
• https://*/* high Broad host access to all HTTPS sites including sensitive banking/finance.
• content_scripts:<all_urls> high Scripts injected on every page the user visits; maximum reach.

Pillar Scores

Bookkeeping