Top Risks

• Privacy policy fetched but too short (115 chars), no extension scope or data collection disclosure — effectively uninformative.
• function_constructor (new Function()) found in bundled JS — dynamic code execution risk.
• Two innerHTML-from-variable DOM-XSS sinks; no CSP present amplifies exploitability.
• Install-URL hijack opens colorway.app/onboarding on install — minor but noteworthy onboarding redirect.
• External JS hosts include third-party domains (dev.us14.list-manage.com = Mailchimp); no CSP to constrain them.

Evidence

• no_csp crx content_security_policy is null (MV3 default CSP applies but no custom hardening); amplifies DOM-sink risk.
• privacy_policy_too_short store Policy fetched (length=115) but scope_extension=false and data_collection=false — inadequate disclosure.
• function_constructor crx new Function() found in js/app.d104596b.js — dynamic code execution, risk of eval-equivalent misuse.
• dom_sink_innerhtml crx Two innerHTML sinks in dribbble-helper.js and webcomponents-bundle.js with no CSP guard.
• install_url_hijack crx onInstalled opens https://colorway.app/onboarding — own domain, low severity but onboarding redirect present.
• external_hosts crx JS contacts dev.us14.list-manage.com (Mailchimp), github.com, microsoftedge.microsoft.com, polymer.github.io.
• verified_publisher store verified_publisher=true; chroma.dev resolves, looks_throwaway=false — credibility positive.
• no_cve crx cve_findings_raw is empty; no known-vulnerable libraries detected.

Permissions Breakdown

• activeTab medium Access to current tab on user action; limited scope but enables DOM/URL read.
• scripting medium Allows injecting scripts into pages; combined with activeTab, enables DOM manipulation.
• storage low Local data persistence only; no network exfil capability on its own.
• contextMenus low Adds right-click menu items; low standalone risk.

Pillar Scores

Bookkeeping