Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — NES Emulator [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• <all_urls> host permission + content_scripts on every page: NES emulator has no legitimate need to run on all sites.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• declarativeNetRequest paired with <all_urls> allows silent request blocking/redirection on any site visited.
• Free-webmail Gmail developer with no verified publisher badge; unverifiable identity raises future-compromise risk.

Evidence

• broad_host_permission manifest host_permissions: <all_urls> — NES emulator function does not justify access to every website.
• content_script_all_urls manifest content_scripts_matches: <all_urls> — code injected into every page the user visits.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() used in background.js and content_script.js — dynamic code execution risk.
• external_cdn manifest js_external_hosts: unpkg.com — third-party CDN dependency; supply-chain risk.
• free_webmail_dev store Developer email hunkiepeanut.dev@gmail.com; no verified publisher; unverifiable identity.
• small_install_high_perm api 40 installs with HIGH-tier permissions (<all_urls>); install_perm_anomaly flagged.
• scope_mismatch store NES emulator promises local ROM playback but requests declarativeNetRequest + <all_urls> globally.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — NES Emulator [adware] + malext.io malicious_extension_sentry; score 5.47 -> 7.97 (+2.5 cap 2.5).

Permissions Breakdown

• tabs medium Access to tab URLs/titles; medium risk on its own.
• storage low Local key-value storage; low risk.
• declarativeNetRequest medium Can block/redirect network requests; meaningful capability for an emulator.
• <all_urls> (host_permissions) high Broad host access across every site; combined with content_scripts creates high reach.
• <all_urls> (content_scripts) high Content script injected on every page; can read/modify all page content.

Pillar Scores

Bookkeeping