Top Risks

• Privacy policy admits data collection and third-party sharing but is not scoped to this extension (generic company policy).
• Brand impersonation: extension name references eBay but developer (Frooition) is not eBay.
• Content script injected on <all_urls> with no CSP; innerHTML DOM-XSS sink present.
• No CSP on MV3 extension with external JS hosts (cdn.frooition.com, frooition.com) — remote code execution surface.
• Featured-by-Google badge present but does not offset brand-mention impersonation or privacy policy deficiency.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[ebay]; confirmed_owner=false; dev domain froo.com.
• privacy_policy_generic api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• content_scripts_all_urls manifest content_scripts_matches=[<all_urls>]; no declared permissions[] beyond content script injection.
• dom_xss_sink crx init.js: innerHTML assigned from variable; no CSP to mitigate. dom_sink_innerhtml_userctrl + csp_present=false → +2.0.
• external_js_hosts crx js_external_hosts=[cdn.frooition.com, frooition.com]; both dev-controlled; no bad-host hits.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount (featured badge).
• no_cve_findings crx cve_findings_raw=[]; CVE pillar=0.0.
• maintenance_current store months_since_update=4; last_updated=February 19, 2026; maintenance pillar=0.0.

Permissions Breakdown

• content_scripts:<all_urls> high Content script injected into every page; can read/mutate DOM on all sites.

Pillar Scores

Bookkeeping