Top Risks

• Uninstall and install URL hijack to mariogame.xyz — classic traffic/affiliate monetization shell
• eval() of user-controlled input + new Function() constructor with no CSP — arbitrary code execution surface
• Privacy policy is Google's generic policy — does not scope to this extension, admits data collection and 3rd-party sharing
• No developer identity: no name, no email, no verified publisher — zero accountability
• Broad host permissions (*://*/*) + content scripts on all URLs enable full page read/modify on every site

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL -> https://mariogame.xyz/uninstall/ (+3.0 Webstore)
• install_url_hijack crx onInstalled opens https://mariogame.xyz/api/install (+2.0 Webstore)
• eval_user_input + function_constructor crx eval(onclick var) in ui.js; new Function(editor.rawfunc) in editor.js — code execution risk
• generic_privacy_policy store Policy is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true -> +10.0 Privacy
• no_developer_identity store developer_name, developer_email, verified_publisher all absent/false -> Reputation 8.0
• broad_host_permissions manifest *://*/* in host_permissions + content_scripts — full site access on every URL
• no_csp manifest content_security_policy is null; csp_present=false — no inline-script restriction
• js_external_host_mariogame_xyz crx Extension contacts mariogame.xyz — same domain as install/uninstall hijacks, monetization fingerprint

Permissions Breakdown

• declarativeNetRequest medium Allows network request interception/blocking rules across all sites; medium risk alone.
• host_permissions: *://*/* high Broad host access to every URL; pairs with declarativeNetRequest for full traffic manipulation.
• content_scripts: *://*/* high Content scripts injected on every page; can read/modify any page content.

Pillar Scores

Bookkeeping