Top Risks

• Privacy policy is generic Google account policy — does not scope to this extension's data collection practices.
• Gmail developer with no verified business; brand_mention flags 'discord' as impersonation risk.
• No CSP + innerHTML sinks in React bundle create DOM-XSS exposure on Discord pages.
• Free-webmail developer identity with 100K installs increases supply-chain compromise value.
• React 16.13.1 bundled — below React 16.4 threshold check not triggered, but outdated and no CSP mitigates exploitability.

Evidence

• privacy_policy_generic store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true) → Privacy pillar +10.
• brand_impersonation store brand_mention.is_impersonation=true; brand=discord; dev=prathercc@gmail.com; not verified publisher.
• free_webmail_dev store Developer email is gmail.com; no business domain; no verified_publisher badge.
• no_csp crx content_security_policy is null on MV3 extension; amplifies innerHTML DOM-XSS risk.
• dom_sink_innerhtml crx Two files contain innerHTML user-controlled sink; no CSP and cve_findings empty → +2.0 (FIX B).
• is_featured_by_google store Google Featured badge present → Reputation -2.0 discount applied.
• host_scope_discord_only manifest All host_permissions scoped to discord.com/discordapp domains; justified-broad discount applied.
• operator_cluster_clean api sibling_count=0; no related extension cluster detected; no bad/affiliate/monetization hosts.

Permissions Breakdown

• storage low Stores extension state/settings locally; no user-data exfil risk on its own.
• host: *://discord.com/* medium Content-script access to Discord; scoped to one domain but enables DOM/message read.
• host: *://*.discord.com/* medium Extends Discord subdomain access; justified by stated Discord management function.
• host: *://*.discordapp.com/* medium Discord CDN/media subdomain; justified by stated function.
• host: *://*.discordapp.net/* medium Discord assets subdomain; justified by stated function.

Pillar Scores

Bookkeeping