Top Risks

• Broad <all_urls> host access with content script on all HTTPS pages
• Privacy policy admits data collection and third-party sharing without extension scope
• Unverified publisher with sparse listing metadata (0 ratings)
• Medium CVE in bundled zod library

Evidence

• host_permissions <all_urls> manifest Extension requests access to all websites; content script matches https://*/*
• privacy_policy_classification api Fetched policy: scope_extension=false, data_collection=true, third_party_sharing=true -> +10.0 per v3.5(D)
• cve_findings_raw api 1 medium CVE: zod DoS (CVE-2023-4316); MV3 so no CSP amplifier
• code_findings_raw empty, obfuscation 0.0 crx No suspicious JS signals; 5 files scanned; no external hosts
• developer identity store Unverified publisher; cyera.io domain resolves, cert since 2021; no impersonation detected
• installs/ratings store 3,000 installs, 0 ratings; no review red flags
• maintenance store Last updated Oct 19, 2026 (0 months); actively maintained
• threat_intel clean api No bad hosts, monetization, or affiliate hits; no operator siblings

CVE Exposures (1)

Permissions Breakdown

• storage low Low-risk local data storage
• alarms low Low-risk timer API
• identity low Low-risk identity API without scopes
• identity.email low Access to user email; low risk alone
• webNavigation medium Monitors navigation events across visited sites
• scripting medium Enables script injection into pages
• host:<all_urls> high Broad host access to every website
• content_scripts:https://*/* high Content script runs on all HTTPS pages

Pillar Scores

Bookkeeping