Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• Uninstall and install URL hijacks redirect to soundbooster.io — monetization/tracking signal.
• Developer is anonymous (no name) with free-webmail Gmail; verified_publisher badge is present but identity unconfirmed.
• Content scripts injected on <all_urls> with DOM innerHTML sinks — potential XSS vector on every visited site.
• tabCapture permission enables audio stream interception from any captured tab.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL → https://soundbooster.io/uninstall; 3rd-party tracking on uninstall.
• install_url_hijack manifest onInstalled opens https://soundbooster.io/install; monetization/tracking on install.
• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• dom_sink_innerhtml crx innerHTML assignment in popup.js and contentScript.js; DOM-XSS sink on all pages.
• anonymous_developer store developer_name is empty; email is free Gmail mo77massey@gmail.com; no business identity.
• verified_publisher_featured store Extension has verified_publisher=true and is_featured_by_google=true, partially mitigating rep risk.
• host_permissions_all_urls_with_content_scripts manifest <all_urls> host_permission + content_scripts on <all_urls>; broad reach across all sites.
• js_external_hosts crx Extension references reactjs.org and soundbooster.io as external JS hosts.

Permissions Breakdown

• storage low Stores user settings locally; low risk.
• activeTab medium Access to current tab on user action; scoped but still meaningful.
• tabCapture high Captures tab audio stream; high capability for audio interception.
• offscreen low Needed for audio processing offscreen; low standalone risk.
• <all_urls> (host_permission) high Broad host access paired with content_scripts on all URLs; high reach.
• content_scripts <all_urls> high Content scripts injected on every site; DOM manipulation on any page.

Pillar Scores

Bookkeeping