Top Risks

• Privacy policy URL points to Chrome Web Store listing page, not a scoped policy — no retention info disclosed.
• new Function() constructor in pageWorld.js enables dynamic code execution; risk amplified by absence of CSP.
• No CSP declared (MV3 default applies) and no developer name listed in store.
• Privacy policy discloses third-party sharing without scoping to this extension.
• Fetched policy is the store listing page (~563KB), likely generic — not an extension-specific policy.

Evidence

• privacy_policy_is_store_listing store privacy_policy_url resolves to the extension's own CWS listing, not a dedicated policy page.
• function_constructor_found crx pageWorld.js uses new Function() constructor; dynamic code execution without CSP protection.
• no_csp_declared manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• third_party_sharing_in_policy store privacy_policy_classification.third_party_sharing=true but scope_extension=true and data_collection=false.
• no_developer_name store developer_name is empty string; identity relies solely on email domain cloudhq.net.
• featured_by_google store is_featured_by_google=true; positive trust signal reducing reputation risk.
• cve_findings_empty crx No CVEs found; jquery 3.7.1 and react 0.20.2 bundled but no known vulnerabilities flagged.
• host_permissions_scoped manifest Host permissions limited to Gmail, cloudhq.net, googleusercontent.com — matches stated function.

Permissions Breakdown

• scripting medium Can inject scripts into matched pages (Gmail); scoped to mail.google.com only.
• storage low Local preference storage; no cross-site data sharing.
• background low Persistent background context; expected for email tracking protection.
• declarativeNetRequest medium Can block/redirect network requests; core function of tracking protection.
• declarativeNetRequestFeedback low Read-only feedback on blocked requests; informational only.
• host:https://mail.google.com/ medium Full access to Gmail; justified for email tracking detection.
• host:https://inbox.google.com/ medium Access to legacy Gmail Inbox; scoped, justified.
• host:https://www.cloudhq.net/ low Dev's own domain; expected for config/updates.
• host:*://*.googleusercontent.com/* medium Broad Google CDN access needed to intercept tracking pixels in emails.
• host:*://taskassist-pa.clients6.google.com/* low Specific Google internal API; narrowly scoped.

Pillar Scores

Bookkeeping