Top Risks

• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — scores maximum privacy risk.
• tabCapture + scripting + <all_urls>: can capture audio/video from every tab and inject arbitrary code on every site.
• Developer uses free Gmail address with no developer name — low accountability for a 100K-install extension.
• new Function() constructor found in 4 JS files — dynamic code execution risk, albeit a common bundler pattern.
• Verified/featured discounts applied but Gmail dev identity limits trust; no developer domain info available.

Evidence

• privacy_policy_generic_with_3rd_party api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — triggers D (+10.0 privacy).
• free_webmail_developer store Developer email terry44petit@gmail.com; no developer name listed; no verified business identity.
• tabCapture_plus_all_urls manifest tabCapture with <all_urls> host permission and content_scripts on all URLs — high capability reach.
• scripting_all_urls manifest scripting permission paired with <all_urls> enables arbitrary JS injection on every page.
• function_constructor_4_files crx new Function() found in background.js, content.js, offscreen.js, popup.js — dynamic code execution.
• verified_publisher_featured store Verified publisher + featured badge; discount capped due to Gmail identity concerns.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• install_count_100k store 100,000 installs; broad reach amplifies any risk from high permissions.

Permissions Breakdown

• storage low Stores user preferences locally.
• tabCapture high Captures audio/video from tabs; broad surveillance capability.
• offscreen low Used for audio processing off-screen; low standalone risk.
• scripting high Injects scripts into pages; paired with <all_urls> is high risk.
• tabs medium Reads tab URLs and metadata across all open tabs.
• <all_urls> (host) high Grants access to every site visited; broad attack surface.
• <all_urls> (content_scripts) high Content scripts run on every page automatically.

Pillar Scores

Bookkeeping