Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; data_collection+third_party_sharing admitted without extension context (+10.0).
• Free-webmail dev (outlook.com) with no developer name raises identity accountability risk significantly.
• webRequest + scripting + <all_urls>: extension can observe and manipulate every HTTP request and page across all sites.
• Both install_url_hijack and uninstall_url_hijack flagged; unknown redirect targets indicate potential monetization/tracking.
• new Function() constructor in fn_ggn.js enables dynamic code execution with no CSP to constrain it.

Evidence

• free_webmail_dev_no_name store developer_email=smartdeskteam@outlook.com; developer_name empty; no business domain.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to extension; scope_extension=false, data_collection=true, third_party_sharing=true.
• install_url_hijack crx install_url_hijack=true; target unknown. Unsolicited redirect on install.
• uninstall_url_hijack crx uninstall_url_hijack=true; target unknown. Uninstall redirect active (+3.0 Webstore).
• webRequest_plus_all_urls manifest webRequest + scripting paired with <all_urls> host_permissions; content_scripts_matches=*://*/*.
• function_constructor_code crx fn_ggn.js: new Function() constructor detected; dynamic code eval risk with no CSP.
• no_csp manifest content_security_policy=null; MV3 strict default applies but inline eval risk from Function() constructor remains.
• verified_publisher store verified_publisher=true but months_since_update=7 and free-webmail identity; discount capped per invariant 0c rules.

Permissions Breakdown

• alarms low Scheduling only; minimal attack surface.
• tabs medium Can read tab URLs and titles across all sites.
• storage low Local data persistence only.
• unlimitedStorage low Quantity concern only; no extra data access.
• declarativeNetRequest medium Can block/redirect network requests; fits blocker category.
• webRequest high Can observe all network requests across <all_urls>.
• scripting high Can inject scripts into any page via <all_urls> host permission.
• <all_urls> high Broad host access amplifies webRequest and scripting to every site visited.

Pillar Scores

Bookkeeping