Top Risks

• Privacy policy fetched but scope_extension==false AND data_collection+third_party_sharing both true — admits data sharing without scoping to this extension (Privacy pillar maxed at 10.0).
• Broad host_permissions (http://*/*, https://*/*) combined with scripting enables content injection on any site the user visits.
• No content_security_policy (MV3 strict default helps, but innerHTML sink + new Function() in code amplifies XSS exposure).
• 10 distinct external JS hosts including zapier.com, formatjs.io, reactjs.org, api.qunitjs.com — wide network surface for an RSS reader.
• developer_name field empty; no verified publisher badge; privacy policy does not scope data practices to this extension.

Evidence

• broad_host_permissions manifest http://*/* and https://*/* grant content-script and scripting access to every site visited.
• privacy_policy_scope_mismatch crx Policy fetched (28545 chars); scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10 privacy score.
• no_csp manifest content_security_policy is null; no explicit CSP declared. MV3 default applies but DOM sinks present.
• dom_innerhtml_sink crx subscribe.js: innerHTML assigned from variable — DOM-XSS sink with no CSP guard.
• function_constructor_usage crx new Function('return this') pattern found in mv3.js, offscreen.js, vendor--.js — dynamic code execution.
• wide_external_hosts crx 10 external JS hosts: zapier.com, formatjs.io, api.qunitjs.com, reactjs.org plus 6 feeder.co subdomains.
• no_developer_name store developer_name is empty string; identified only by support@feeder.co and domain feeder.co.
• featured_by_google store is_featured_by_google=true — partial trust signal; not verified publisher, discounts are limited.

Permissions Breakdown

• tabs medium Can read tab URLs and titles across all open tabs.
• chrome://favicon/ low Read-only favicon access for feed display.
• storage low Local data persistence for feed subscriptions and settings.
• scripting medium Can inject scripts into pages; paired with broad host permissions elevates risk.
• notifications medium Can show desktop notifications; potential for abuse but matches feed-alert use case.
• declarativeNetRequest medium Can modify/block network requests declaratively.
• unlimitedStorage low Extended storage quota for feed caching.
• contextMenus low Adds right-click menu items; low standalone risk.
• alarms low Periodic wake for feed polling; expected for RSS reader.
• offscreen low Off-screen document for background processing; low risk in isolation.
• http://*/* high Broad host access to all HTTP sites; scripting injection on any page.
• https://*/* high Broad host access to all HTTPS sites; combined with scripting is high-risk surface.

Pillar Scores

Bookkeeping