Top Risks

• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Developer is anonymous gmail user (birch6272@gmail.com) with no business identity, no dev name, verified publisher status notwithstanding.
• contentSettings + scripting + <all_urls> allows altering site permissions and injecting code on every visited page.
• install_url_hijack flag is true — extension opens a URL on install (target unknown).
• desktopCapture can record screen/audio; combined with Google Analytics telemetry contact and opaque developer identity is a concern.

Evidence

• privacy_policy_generic api Policy URL is Google Account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy pillar.
• developer_anonymous_gmail store developer_email=birch6272@gmail.com, developer_name empty, no business website; free-webmail identity.
• install_url_hijack crx install_url_hijack=true with null target; onInstalled opens unknown URL — monetization/tracking risk.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; partially offsets reputation risk.
• high_permissions_broad_host manifest scripting+contentSettings+desktopCapture+<all_urls> grants cross-site script injection and permission mutation.
• no_csp crx content_security_policy=null on MV3; MV3 has strict default but CSP absence noted.
• google_analytics_contact api monetization_hits: www.google-analytics.com (telemetry tier); only telemetry hit, not ad-tech.
• cve_findings_empty crx No CVEs found; cve_findings_raw=[]; CVE pillar=0.0.

Permissions Breakdown

• tabs medium Access to tab URLs/titles; medium risk on its own.
• contentSettings high Can alter per-site permissions (camera, mic, cookies) across all sites.
• storage low Local extension data storage; low standalone risk.
• downloads medium Can save files to disk; moderate risk.
• desktopCapture high Full screen/audio capture capability; core function but high-impact.
• scripting high Can inject arbitrary JS into any page via <all_urls> host permission.
• alarms low Periodic wake-up; minimal standalone risk.
• <all_urls> (host_permissions) high Combined with scripting and contentSettings gives full cross-site capability.
• <all_urls> (content_scripts) high Content scripts injected on every page; broad reach.

Pillar Scores

Bookkeeping