Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy is ConsenSys corporate policy (scope_extension=false, admits data collection and 3rd-party sharing) — not scoped to this extension.
• webRequest + <all_urls> + content_scripts on all URLs: full network observation and DOM access on every site visited.
• management permission allows enumeration/disabling of other installed extensions.
• No CSP declared (MV3 strict default mitigates but no explicit policy) and Function() constructor used across 6 files.

Evidence

• broad_host_access manifest host_permissions=[<all_urls>] + content_scripts on <all_urls>; extension touches every site the user visits.
• webRequest_all_urls manifest webRequest paired with <all_urls> allows passive observation of all network traffic.
• management_permission manifest management permission can list, enable, or disable other installed extensions.
• privacy_policy_not_scoped store Policy at consensys.io/privacy-notice: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• function_constructor_multiple_files crx new Function() constructor found in 6 JS files; maps to +2.5 code quality (function_constructor signal).
• posthog_telemetry crx app.posthog.com in js_external_hosts; behavioral analytics endpoint collecting user interaction data.
• react_16_13_1_bundled crx react@16.13.1 detected via license sidecar; below React 16.4 CVE threshold but version is old (2020).
• developer_name_missing store developer_name is empty; only developer_email support@walletguard.app provided. Domain resolves; not throwaway.

Permissions Breakdown

• storage low Local data persistence; minimal risk.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• alarms low Background scheduling; minimal risk.
• management high Can enumerate/disable other extensions; significant capability.
• notifications low Show desktop notifications; low risk standalone.
• contextMenus low Adds right-click menu items; low risk.
• webRequest high Observes all network requests across all URLs; high surveillance capability.
• <all_urls> (host_permissions) high Content scripts injected on every site; broad reach amplifies all other risks.

Pillar Scores

Bookkeeping