Top Risks

• No developer identity: no name, email, or domain — zero accountability.
• Privacy policy is generic Google account policy, not scoped to this extension; admits data collection and third-party sharing.
• Content scripts on <all_urls> with scripting permission give full DOM access to every site.
• Extension name/description uses MSG placeholders — listing not properly localised, low legitimacy signal.
• DOM-XSS sink (innerHTML) found in popup.js with no CSP protection.

Evidence

• host_permissions=<all_urls> + content_scripts on <all_urls> manifest Extension reads/modifies every page the user visits.
• No developer identity store developer_name, developer_email, and developer_domain all empty; no accountability.
• Privacy policy is generic Google account policy crx scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy classification.
• dom_sink_innerhtml_userctrl in js/popup.js crx innerHTML assigned from variable without sanitisation; no CSP to mitigate.
• js_external_hosts includes github.com and google-analytics.com crx Analytics telemetry confirmed; github.com contact raises dynamic-load concern.
• manifest_name/__MSG_extName__ manifest Extension title not resolved — store listing unverifiable.
• monetization_hits: google-analytics.com api Telemetry-tier hit only; penalised at +1.0 webstore per telemetry-only rule.
• csp_present=false + MV3 manifest No explicit CSP declared; MV3 provides default but innerHTML sink still exploitable.

Permissions Breakdown

• storage low Local key-value storage only; low direct harm.
• scripting medium Allows programmatic script injection; elevated when paired with <all_urls>.
• alarms low Scheduling only; minimal standalone risk.
• <all_urls> (host_permissions) high Full read/write access to every site the user visits.
• <all_urls> (content_scripts) high Content scripts injected on every page; broad DOM access.

Pillar Scores

Bookkeeping