Top Risks

• Brand impersonation: 'Youtube™' in title, unverified developer, gmail dev email (mica.muller2029@gmail.com).
• Privacy policy admits data collection + third-party sharing but not scoped to this extension — maps to +10.0 privacy score.
• Extension not updated in 36 months (zombie); maintenance pillar maxes out at 10.0.
• Both install-URL and uninstall-URL hijacks flagged; uninstall redirect to unknown 3rd party.
• Developer uses free webmail (gmail), no verified publisher, no business domain — elevated identity risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[youtube]; confirmed_owner=false; dev domain is gmail.com.
• install_and_uninstall_url_hijack crx install_url_hijack=true AND uninstall_url_hijack=true; targets unknown — uninstall redirect to 3rd party.
• privacy_policy_scope_fail api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case classification.
• stale_extension store Last updated June 6 2023; months_since_update=36 — max maintenance score 10.0 + zombie >36mo.
• free_webmail_developer store Developer email mica.muller2029@gmail.com; no business website; not verified publisher.
• privacy_policy_on_unrelated_domain api Policy URL is audio-editor.freeonlineapps.net — unrelated to this extension's stated function.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit policy declared.
• no_cve_findings crx cve_findings_raw=[]; no bundled vulnerable libraries detected.

Permissions Breakdown

• content_scripts: *://www.youtube.com/* low Scoped to YouTube only; matches stated floating video player function.

Pillar Scores

Bookkeeping