Top Risks

• Brand impersonation: mentions 'Perplexity' and 'Google' in name/description; developer is unaffiliated gmail user 'AaronThug'.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Developer is free-webmail (gmail) with no verified business identity, no publisher badge.
• Extension is 19 months stale; no rating or user reviews to validate behavior.
• External JS host aaron.berlinblick.de is a personal domain with unknown content; CSP allows connect to it implicitly via script-src self.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands=['perplexity','google']; developer is gmail user, confirmed_owner=false.
• free_webmail_developer store developer_email=aaronthug.dev@gmail.com; no verified publisher; developer_domain=gmail.com.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_host crx js_external_hosts includes aaron.berlinblick.de — personal domain unrelated to Perplexity or Google.
• stale_extension store months_since_update=19; last_updated=2024-11-20; MV3 but approaching 24mo stale threshold.
• very_low_installs store Only 153 installs; no ratings; tail attack surface if permissions escalate in future update.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, cve_findings_raw empty — low technical risk today.
• csp_present_mv3 manifest CSP restricts script-src to self, connect-src to api.perplexity.ai only; MV3 strict defaults apply.

Permissions Breakdown

• host: https://www.google.com/* medium Content script injection on Google search pages; matches stated function.
• host: https://api.perplexity.ai/* medium Sends data to Perplexity AI API; core function but user data leaves browser.
• host: https://www.google.de/* medium Scoped to Google Germany search; same surface as google.com host permission.

Pillar Scores

Bookkeeping