Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension; admits data collection and 3rd-party sharing (D rule: +10.0).
• Uninstall URL redirects to 3rd-party vidsbee.com — monetization/tracking signal post-uninstall.
• Content scripts declared on <all_urls> giving passive DOM access to every site visited.
• Developer email is free-webmail (gmail) with no business name; no verified publisher badge.
• 12 external JS hosts referenced including non-dev domains (amazon.com, urltocheck1.org, javascripter.net).

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to vidsbee.com — 3rd-party tracking on removal.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; extension runs on every page.
• free_webmail_dev_no_name store developer_email=samlarison+noreply@gmail.com; developer_name empty; no verified_publisher.
• dom_sink_innerhtml crx Cr.js: innerHTML assigned from variable; DOM-XSS sink with CSP present → +0.5 only.
• js_external_hosts_broad crx 12 external hosts: includes urltocheck1.org, www.amazon.com, www.javascripter.net alongside dev domain.
• verified_publisher store verified_publisher=true but no recognized org; gmail dev email limits discount.
• install_count_high store 900,000 installs; blast radius significant if privacy/supply-chain risk materializes.

Permissions Breakdown

• activeTab low Only accesses current tab on user gesture; narrow scope.
• tabs medium Can read tab URLs and metadata across browser session.
• scripting medium Can inject scripts; paired with <all_urls> content_scripts raises surface.
• storage low Local key-value store; low standalone risk.
• clipboardWrite low Write-only clipboard; appropriate for color-copy function.
• content_scripts <all_urls> high Content script runs on every page; broad passive access to page DOM.

Pillar Scores

Bookkeeping