Top Risks

• MANAGEMENT PERMISSION: extension can enumerate and disable other installed extensions (incl. security and privacy tools).
• Privacy policy is for chathub.gg, not this extension — admits data collection and 3rd-party sharing without scoping to Browser Firewall.
• management permission allows disabling/uninstalling any other browser extension — extreme privilege for a firewall tool.
• Extension not updated in 33 months (zombie); abandoned extensions are acquisition/compromise targets.
• Uninstall URL hijack detected — redirects user on removal to unverified destination.

Evidence

• privacy_policy_mismatch store Policy URL is chathub.gg/privacy-policy — different product; admits data_collection=true, third_party_sharing=true, scope_extension=false.
• management_permission manifest management permission grants ability to list, enable, disable, or uninstall all installed extensions.
• stale_extension store Last updated September 25, 2023 — 33 months ago. No active maintenance.
• uninstall_url_hijack crx uninstall_url_hijack=true; target unknown. Post-removal redirect to third party.
• gmail_developer store Developer email wonderfuly@gmail.com — free webmail, no verified business domain.
• low_rating store Rating 2.8 — below threshold; indicates user dissatisfaction.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; 1000 installs with HIGH-tier permission (management).
• no_csp manifest content_security_policy is null on MV3; no CSP declared.

Permissions Breakdown

• management high Can enumerate, disable, or uninstall other extensions — high privilege.
• declarativeNetRequest medium Can block/redirect network requests; core to stated function.

Pillar Scores

Bookkeeping