Top Risks

• cookies + scripting + declarativeNetRequestWithHostAccess on mail.google.com enables broad Gmail data access.
• Three innerHTML DOM-XSS sinks with no CSP — attacker-controlled email content could exploit these.
• Privacy policy discloses third-party data sharing without retention period specified.
• install_url_hijack and uninstall_url_hijack flags set (targets null, but pattern present).
• No developer display name in store listing; identity relies solely on email domain.

Evidence

• verified_publisher+featured store Verified publisher badge and featured by Google — strong trust signal; reputation floor 2.0.
• cookies+scripting+host_permissions manifest cookies, scripting, declarativeNetRequestWithHostAccess scoped to mail.google.com — high-capability combo.
• dom_xss_no_csp crx 3x innerHTML sinks in popup.js, speechRecognition.js, Autolinker.js; csp_present=false amplifies risk.
• privacy_policy_third_party api Policy scoped to extension, data_collection=true, third_party_sharing=true, retention=false.
• install_uninstall_hijack store install_url_hijack=true and uninstall_url_hijack=true; targets are null so no confirmed redirect.
• no_cve_findings crx cve_findings_raw empty; no known-bad hosts; no obfuscation.
• 12_external_hosts crx 12 js_external_hosts including jasonsavard.com, browser-update.org, bitbucket.org, github.com.
• active_maintenance store months_since_update=0; recently updated June 2026.

Permissions Breakdown

• gcm low Push messaging; low risk on its own.
• alarms low Scheduling; minimal risk.
• activeTab medium Access to current tab on user action.
• tts low Text-to-speech output only.
• idle low Detects idle state; low risk.
• notifications low Display notifications; low risk.
• storage low Local extension storage.
• contextMenus low Adds right-click menu items.
• identity medium OAuth token access; scoped to Google identity.
• system.display low Read display info; low risk.
• cookies high Can read cookies; scoped to mail.google.com but still high capability.
• declarativeNetRequestWithHostAccess high Network request interception/modification with host access.
• offscreen low Off-screen document for audio/TTS; low risk.
• scripting high Programmatic script injection into pages.
• sidePanel low Side panel UI; low risk.

Pillar Scores

Bookkeeping