Top Risks

• manifest_source is html_fallback — permissions and code surface could not be verified from CRX
• Privacy policy admits data collection and third-party sharing but no retention period disclosed
• Description promises ad-blocking but no declarativeNetRequest/webRequest permission confirmed — mismatch
• Developer name absent; only email on developer-owned domain
• 2M installs with unverified manifest increases blast-radius uncertainty

Evidence

• manifest_source_html_fallback store Manifest sourced from HTML fallback; CRX not scanned — permissions, code quality, MV version all unverifiable.
• privacy_policy_third_party_sharing api Policy fetched (64KB), scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• description_permission_mismatch store description_promise mismatch: promises ad-blocking but no webRequest/declarativeNetRequest confirmed.
• featured_by_google store Extension carries Google Featured badge — positive trust signal applied.
• developer_name_missing store developer_name is empty string; only email adblock@adblockultimate.net available.
• threat_intel_clean api No bad_host_hits, affiliate_hits, monetization_hits, or throwaway-domain signals detected.
• no_cve_findings api cve_findings_raw is empty; js_files_scanned=0 due to html_fallback — CVE surface unscanned.
• high_install_count store 2,000,000 installs increases blast radius; html_fallback manifest raises surface uncertainty.

Pillar Scores

Scoring History

Bookkeeping