Top Risks

• Extension not updated in 54 months (>36mo) — abandoned, ripe for compromise or takeover.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• brand_mention flags Google impersonation by a non-verified, non-Google developer.
• No CSP declared (MV3 default provides some protection but explicit policy absent).
• Small install base (6K) with stale code increases supply-chain acquisition risk.

Evidence

• abandoned_extension store Last updated December 2021; 54 months since update — zombie tier (+10.0 maintenance).
• generic_privacy_policy store Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• brand_impersonation store brand_mention.is_impersonation=true (Google mentioned); developer not verified nor Google → +2.0 reputation.
• no_csp manifest content_security_policy is null; MV3 so no +2.0 network penalty, but no explicit CSP set.
• js_external_host crx Single external host: images.google.com — consistent with stated reverse-image-search function; no bad/monetization hits.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, 1 JS file scanned — minimal code surface.
• developer_domain_resolves api dejan.com.au resolves, looks_throwaway=false; no wayback ownership change detected.
• cve_findings_empty crx No CVEs found in bundled libraries; cve_pillar_score = 0.0.

Permissions Breakdown

• contextMenus low Adds right-click menu entry; minimal capability, matches stated function.

Pillar Scores

Bookkeeping