Top Risks

• Extension not updated in 46 months (>36mo stale) — abandoned, unpatched surface.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• No CSP present on MV3 extension; +2.0 network penalty applied.
• Privacy policy scope_extension=false with data_collection=true and third_party_sharing=true → maximum privacy score.
• Featured badge provides modest trust offset but cannot offset stale maintenance and inadequate privacy policy.

Evidence

• maintenance_stale store Last updated August 2022; 46 months since update → +10.0 maintenance pillar (>36mo band).
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• no_csp manifest content_security_policy is null on MV3 extension → +2.0 network behavior per v2 calibration fix (b).
• featured_by_google store is_featured_by_google=true → -2.0 reputation (Follows recommended practices badge).
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, no external JS hosts → code quality 0.0.
• no_cve_findings crx cve_findings_raw empty, no bundled libraries detected → CVE pillar 0.0.
• clean_threat_intel api No bad_host_hits, affiliate_hits, monetization_hits; developer domain mvath.de resolves and not throwaway.
• install_count_webstore store 20,000 installs → +1.0 webstore (>10k). No category mismatch, no overrides, no cluster siblings.

Permissions Breakdown

• bookmarks medium Read/write access to all bookmarks; core function but can expose browsing history shape.
• storage low Local extension storage only; no cross-origin risk.

Pillar Scores

Bookkeeping