| tabCapture | Permission | | This permission captures content and audio from browser tabs. Rated High because it can record sensitive web content, capture form input, and monitor user interactions. |
| offscreen | Permission | | This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness. |
| identity | Permission | | This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service. |
| clipboardWrite | Permission | | This permission allows modification of clipboard content. Rated High because it can inject malicious content into the clipboard, modify copied passwords, and manipulate copied data. |
| Contextual Risk Factors | Risk Factor | | The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact |
| activeTab | Permission | | This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions. |
| storage | Permission | | This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads. |
| https://www.googleapis.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://content.googleapis.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://identitytoolkit.googleapis.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://securetoken.googleapis.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://firestore.googleapis.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://firebasestorage.googleapis.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://*.firebaseapp.com/* | Host | | Host permission — access limited to this URL pattern. |
| https://*.cloudfunctions.net/* | Host | | Host permission — access limited to this URL pattern. |
| Access to Sensitive Domains | Risk Factor | | This extension requests access to sensitive domains: https://www.googleapis.com/*, https://content.googleapis.com/*, https://identitytoolkit.googleapis.com/*, https://securetoken.googleapis.com/*, https://firestore.googleapis.com/*, https://firebasestorage.googleapis.com/* |
| notifications | Permission | | This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data. |