Top Risks

• chrome.debugger.attach detected in background.js — extremely high-capability, can read page content, intercept traffic, screenshot any tab.
• Broad host permissions (*://*/*) combined with cookies, browsingData, scripting, and webRequest creates maximal data exfil surface.
• Developer uses free Gmail with no business identity; privacy policy hosted on GitHub Pages lacks retention details.
• Privacy policy discloses data collection AND third-party sharing but lacks retention policy and is not scoped to this extension specifically.
• Low install count (520) with highest-tier permissions (install_perm_anomaly: small_install_high_perm) — disproportionate capability.

Evidence

• debugger_attach crx background.js attaches chrome.debugger to tabs — grants near-total page control beyond normal extension APIs.
• broad_host_permissions manifest *://*/* + http://*/* + https://*/* triple-declared; combined with cookies+scripting+browsingData is maximal reach.
• free_webmail_dev_no_business store Developer email is gmail.com, developer_name empty, no verified business domain.
• privacy_policy_third_party_sharing api Policy fetched: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• install_perm_anomaly store 520 installs with has_high_tier_permission=true; small_install_high_perm=true.
• install_url_hijack crx install_url_hijack=true; opens URL on install (target null — could not be verified benign).
• dom_sink_innerhtml_userctrl crx Two innerHTML sinks from user-controlled variables in coupon.js and data_inspector_dashboard.js.
• verified_publisher_featured store Extension is verified publisher and featured by Google — mitigates some reputation risk.

Permissions Breakdown

• storage low Stores extension settings locally.
• activeTab medium Access to current tab on user action.
• webRequest high Can observe all network requests across all URLs.
• declarativeNetRequest medium Declarative request blocking; lower risk than webRequest.
• declarativeNetRequestWithHostAccess high Declarative net request with broad host access — elevated capability.
• alarms low Periodic background tasks only.
• cookies high Read/write cookies across all origins given broad host permissions.
• browsingData high Can wipe history, cache, cookies — broad destructive/privacy capability.
• webNavigation medium Observe navigation events across tabs.
• tabs medium Access tab URLs and metadata.
• scripting high Inject scripts into any page given <all_urls> host permission.
• *://*/* high Broad host access — all HTTP/HTTPS origins.
• http://*/* high Redundant broad HTTP host access.
• https://*/* high Redundant broad HTTPS host access.
• https://api.lemonsqueezy.com/* medium Payment/licensing API — external monetization endpoint.
• https://docs.google.com/* low Specific Google Docs access for stated features.
• https://*.google.com/* medium Broad Google subdomain access beyond docs.

Pillar Scores

Bookkeeping