Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Content scripts declared against <all_urls> giving broad page-level JS access despite stated Google Docs focus.
• Extension loads JS from external host google-edit.com (non-Google domain) — potential supply-chain risk.
• Developer uses free-webmail (gmail) with no verified publisher badge; identity unverifiable.
• Stale at exactly 18 months; borderline zombie with 50K installs.

Evidence

• content_scripts_matches <all_urls> manifest content_scripts match includes <all_urls> — far broader than stated Google Docs function.
• external JS host: google-edit.com crx JS loaded from google-edit.com — not owned by Google; look-alike domain is high supply-chain risk.
• privacy policy generic Google account policy store URL points to myaccount.google.com global policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free-webmail developer, no verified publisher store Developer konimatoan@gmail.com; verified_publisher=false; identity unverifiable.
• dom_sink_innerhtml_userctrl crx innerHTML from variable in contentScript.js and popup.js — DOM-XSS sinks; CSP present mitigates somewhat.
• months_since_update=18 store Last updated Feb 2025; exactly at 18-month stale threshold with 50K active installs.
• is_featured_by_google=true store Google Featured badge provides partial trust signal but does not verify developer identity.
• obfuscation_score=0.0 crx No obfuscation detected across 5 JS files scanned.

Permissions Breakdown

• storage low Local key-value store; no cross-origin data access.
• system.display low Read-only display info; minimal risk surface.
• content_scripts: *://docs.google.com/* medium Script injection into Google Docs/Sheets/Slides pages.
• content_scripts: <all_urls> high <all_urls> content_script match grants broad page-level JS execution across all sites.

Pillar Scores

Scoring History

Bookkeeping