Top Risks

• Uninstall + install URL hijack to developer's own marketing pages — clear monetization-redirect pattern.
• scripting + *://*/*ホスト access lets extension inject code on every page the user visits.
• Privacy policy discloses data collection and third-party sharing but lacks retention period.
• No developer name listed; low-install extension with HIGH-tier host permissions (tail attack surface).
• No CSP declared (MV3 default mitigates, but innerHTML sink present in bundled React code).

Evidence

• uninstall_url_hijack manifest setUninstallURL points to tabplugins.com marketing page; +3.0 webstore.
• install_url_hijack manifest onInstalled opens tabplugins.com promo URL; +2.0 webstore.
• host_permissions_broad manifest *://*/* paired with scripting — can read/modify all pages.
• privacy_policy_third_party_sharing api Policy admits data collection + third-party sharing; no retention disclosed.
• install_perm_anomaly store 516 installs with HIGH-tier host permission — small-install high-perm flag.
• dom_sink_innerhtml crx innerHTML sink in main bundle (React internals); no CSP to mitigate.
• no_developer_name store developer_name is empty string; reduces accountability.
• verified_publisher store tabplugins.com verified publisher; -3.0 reputation discount (floored at 2.0 cap).

Permissions Breakdown

• storage low Standard key-value storage for extension settings.
• unlimitedStorage low Allows larger local storage quota; low risk alone.
• scripting medium Allows programmatic injection of scripts into pages; elevated when paired with *://*/*.
• *://*/* (host_permissions) high Broad host access across all sites; enables scripting content on every page visited.

Pillar Scores

Bookkeeping