Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Content script injected on <all_urls> gives broad page-level reach despite minimal declared permissions.
• DOM-XSS sink (innerHTML) with no CSP; exploitable if any user-controlled input flows into detailsHtml.
• Developer uses free Gmail address with no verified business identity or domain.
• Extension last updated 23 months ago; approaching zombie threshold with unpatched code.

Evidence

• content_scripts_matches=<all_urls> manifest Content script runs on every URL — broad reach despite only activeTab+notifications in permissions[].
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• dom_sink_innerhtml_userctrl crx content.js assigns user-derived CSS data to popup.innerHTML with no CSP in place.
• no_csp manifest content_security_policy is null; MV3 strict default applies but innerHTML sink still exploitable.
• free_webmail_developer store Developer email zonetwoextension@gmail.com; no business domain or verified publisher badge.
• months_since_update=23 store Last updated July 2024; 23 months stale — near 24-month high-maintenance threshold.
• no_bad_hosts_no_cve crx No external JS hosts, no CVE findings, no obfuscation detected — limits code-quality score.
• operator_cluster_zero_siblings api sibling_count=0; no cluster amplifier applies.

Permissions Breakdown

• activeTab low Grants access only to the currently active tab on user action; narrow scope.
• notifications low Can show desktop notifications; low direct data-access risk.
• content_scripts <all_urls> medium Injects JS into every page visited; broad reach despite low declared permissions.

Pillar Scores

Bookkeeping