Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Camera Picture In Picture (PIP Overlay) [spyware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension at all; admits data collection and 3rd-party sharing (v3.5 Rule D: +10.0).
• No developer name listed in store; identity accountability is weak.
• Manifest uses i18n placeholders for name/description, reducing store-level transparency.
• Maintenance score elevated: 6 months since last update (borderline stale).

Evidence

• generic_privacy_policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — Rule D applies: +10.0 privacy.
• verified_publisher store Verified publisher badge present; discount capped at -1.0 per v3.5 Rule E (monetization/scope issue).
• no_permissions manifest permissions[], host_permissions[], content_scripts_matches[] all empty — minimal capability surface.
• no_external_js_hosts crx js_external_hosts empty; no outbound network surface observable.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0 — clean static scan.
• no_developer_name store developer_name is empty string; reduces identity accountability.
• domain_age api webcameffects.app first cert 2023-11-16, age 1034 days, cert_count=133 — not new, resolves.
• maintenance store 6 months since last update — borderline stale band (+1.5).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Camera Picture In Picture (PIP Overlay) [spyware] [divergent] + malext.io malicious_extension_sentry; score 2.86 -> 5.36 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping