Top Risks

• Broad host permissions (all http/https) paired with scripting allow JS injection on every site visited.
• Brand name includes 'Google™' with is_impersonation=true; developer is not a Google affiliate.
• Uninstall URL hijack flag is true — extension registers an uninstall URL to third party.
• Privacy policy does not disclose data retention; third-party sharing silence adds uncertainty.
• No developer name listed in store despite verified publisher status.

Evidence

• broad_host_permissions manifest host_permissions include http://*/** and https://*/** giving scripting access to all sites.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; confirmed_owner=false; developer is carlosjeurissen.com.
• uninstall_url_hijack crx uninstall_url_hijack=true; uninstall_url_target=null (target not captured).
• verified_publisher_featured store Extension has verified_publisher=true and is_featured_by_google=true, reducing reputation risk.
• privacy_policy_gaps api Policy fetched; scope_extension=true, data_collection=true, retention=false, third_party_silence=true.
• csp_present_strict manifest MV3 with strict CSP; script-src 'self' only; no unsafe-eval or remote JS loading.
• no_code_findings crx code_findings_raw empty; obfuscation_score=0.0; 10 JS files scanned cleanly.
• developer_domain_resolves api carlosjeurissen.com resolves, looks_throwaway=false; single country NL geo diversity.

Permissions Breakdown

• scripting medium Can inject JS into pages; broad host_permissions make this higher surface.
• sidePanel low UI surface only, no data access by itself.
• storage low Local extension storage; standard and expected.
• tabs medium Can read tab URLs and titles across all open tabs.
• http://*/** high Broad host permission covers all HTTP sites for scripting injection.
• https://*/** high Broad host permission covers all HTTPS sites for scripting injection.

Pillar Scores

Bookkeeping