Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, admits data_collection + third_party_sharing) — scores max 10.0 under v3.5 rule D.
• Uninstall URL hijack detected (uninstall_url_hijack=true) — +3.0 webstore signal.
• Install URL hijack detected (install_url_hijack=true) — +2.0 webstore signal.
• Developer uses free webmail (protonmail.com) with no verified business identity — elevated reputation risk.
• Extension contacts k-ext.pages.dev (unknown third-party CDN) and Google Analytics with no CSP.

Evidence

• privacy_policy_generic store Policy is Google's account privacy page: scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() to third party confirmed by scanner.
• install_url_hijack crx onInstalled opens third-party URL per scanner signal.
• free_webmail_developer store Developer email kristian.nessa@protonmail.com; no verified business domain.
• external_hosts crx JS contacts k-ext.pages.dev and www.google-analytics.com; no CSP on MV3 extension.
• telemetry_only_monetization api monetization_hits contains google-analytics.com only (telemetry tier); +1.0 webstore.
• featured_by_google store is_featured_by_google=true; applies -2.0 reputation discount.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty.

Permissions Breakdown

• storage low Used to save high score locally; minimal risk.

Pillar Scores

Bookkeeping