Top Risks

• <all_urls> host permission + content_scripts on every page: NES emulator has no legitimate need to run on all sites.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• declarativeNetRequest paired with <all_urls> allows silent request blocking/redirection on any site visited.
• Free-webmail Gmail developer with no verified publisher badge; unverifiable identity raises future-compromise risk.
• js_external_hosts includes unpkg.com (CDN); supply-chain risk if pinning not enforced.

Evidence

• broad_host_permission manifest host_permissions: <all_urls> — NES emulator function does not justify access to every website.
• content_script_all_urls manifest content_scripts_matches: <all_urls> — code injected into every page the user visits.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() used in background.js and content_script.js — dynamic code execution risk.
• external_cdn manifest js_external_hosts: unpkg.com — third-party CDN dependency; supply-chain risk.
• free_webmail_dev store Developer email hunkiepeanut.dev@gmail.com; no verified publisher; unverifiable identity.
• small_install_high_perm api 40 installs with HIGH-tier permissions (<all_urls>); install_perm_anomaly flagged.
• scope_mismatch store NES emulator promises local ROM playback but requests declarativeNetRequest + <all_urls> globally.

Permissions Breakdown

• tabs medium Access to tab URLs/titles; medium risk on its own.
• storage low Local key-value storage; low risk.
• declarativeNetRequest medium Can block/redirect network requests; meaningful capability for an emulator.
• <all_urls> (host_permissions) high Broad host access across every site; combined with content_scripts creates high reach.
• <all_urls> (content_scripts) high Content script injected on every page; can read/modify all page content.

Pillar Scores

Bookkeeping