Top Risks

• Uninstall and install URL hijack to external domain allowcopy.xyz
• webRequest + *://*/* host access lets extension observe all traffic
• Generic Google privacy policy admits data collection and 3rd-party sharing
• Anonymous Gmail developer, gibberish handle, no business presence
• 480 installs with high-tier permissions is a tail-attack surface

Evidence

• webRequest + universal host access manifest permissions include webRequest and host_permissions *://*/* enabling traffic observation on all sites.
• Uninstall URL hijack crx uninstall_url_hijack=true and install_url_hijack=true pointing at 3rd-party allowcopy.xyz.
• Generic privacy policy store Privacy link is Google account policy, scope_extension=false, admits collection and 3rd-party sharing.
• Developer identity store Free Gmail address hhkregedgjhytrw@gmail.com, no business site, unverified publisher.
• Outbound requests crx js_external_hosts includes allowcopy.xyz contacted from all-pages context.
• Install/permission anomaly api install_perm_anomaly: 480 installs with high-tier permissions; tail_attack_surface=true.
• Maintenance age store Last updated Aug 13, 2025; 14 months since update.
• Code findings crx code_findings_raw empty; obfuscation_score 0.0; 5 JS files scanned.

Permissions Breakdown

• tabs medium Read tab metadata; medium risk per rubric.
• scripting medium Programmatic script injection on any site with broad host access.
• storage low Local settings storage only.
• webRequest high Observe all network traffic; paired with *://*/* host access.
• host_permissions:*://*/* high Universal host access; ×1.2 multiplier with webRequest.

Pillar Scores

Bookkeeping