Top Risks

• Brand impersonation: extension uses 'Zoom' branding without being the verified Zoom owner (brand_mention.is_impersonation=true).
• Privacy policy admits data_collection=true and third_party_sharing=true but is not scoped to this extension — triggers D (generic/broad policy) → +10.0 privacy pillar.
• Extension is 32 months stale (last updated Oct 2023); v3.5 invariant 0c caps verified-publisher discount at -1.0 due to staleness >18mo.
• description_promise.is_shell_pattern=true suggests minimal functionality relative to store presentation.
• No developer name listed; identity accountability is limited to an email on chromeadmin.com.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'zoom'; developer is not confirmed Zoom owner.
• privacy_policy_generic_broad store Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D → +10.0 privacy.
• stale_extension store 32 months since last update; verified-publisher discount capped at -1.0 per v3.5 invariant 0c (stale>18mo).
• shell_pattern store description_promise.is_shell_pattern=true; extension promises play_or_open action with minimal declared permissions.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discount capped at -1.0 due to staleness.
• no_developer_name manifest developer_name is empty string; accountability relies solely on ext@chromeadmin.com.
• content_scripts_scoped crx All 56 content_script matches scoped to *.zoom.us/* and *.zoomgov.com/* — consistent with stated function.
• no_code_findings_no_cves crx code_findings_raw=[], cve_findings_raw=[], obfuscation_score=0.0, js_external_hosts=[] — clean scan surface.

Permissions Breakdown

• content_scripts(*://*.zoom.us/*, *://*.zoomgov.com/*) low Scoped to zoom.us and zoomgov.com only; matches stated function of closing meeting pages.

Pillar Scores

Bookkeeping