Top Risks

• Privacy policy fetched but scope_extension==false and data_collection==true; does not scope to this extension.
• 21 months since last update — approaching stale threshold with installs >100K.
• Uninstall URL hijack flag set (uninstall_url_hijack=true); target unknown.
• Install URL hijack flag set (install_url_hijack=true); target unknown.
• No CSP on MV3 extension; innerHTML DOM-XSS sink present in utility.js.

Evidence

• verified_publisher + featured store Extension is verified publisher AND featured by Google; reputation discounts applied (floor 2.0).
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=false → +9.0 privacy.
• months_since_update=21 store Last updated Sep 2024; 21 months → +6.0 maintenance pillar (12-24mo band).
• install_url_hijack + uninstall_url_hijack crx Both install and uninstall URL hijack flags true; targets null — cannot assess destination.
• dom_sink_innerhtml_userctrl + no_csp crx innerHTML sink in utility.js with csp_present=false → elevated DOM-XSS risk (+2.0 code).
• function_constructor in sentry lib crx new Function() in sentry.7.13.0.dist.js — standard Sentry pattern, low additional risk.
• js_external_hosts count crx 12 external hosts including Firebase, Cloud Functions, api.npoint.io, storage.googleapis.com; >3 distinct domains.
• no_csp_mv3 manifest content_security_policy is null on MV3; default sandbox applies but no explicit hardening.

Permissions Breakdown

• storage low Standard local data persistence for notes; expected for this category.
• identity medium Can access Google identity tokens; elevated risk if misused for auth exfil.
• system.display low Read display info for positioning UI; low harm potential.

Pillar Scores

Bookkeeping