Volume Control
acglggcafiilnibeknihgglelgfafifo
Risk Score
5.81
Risk Level:
Medium
Recommendation:
🟡 MEDIUM RISK — review
Top Risks
- Uninstall URL hijack redirects users to addonup.com on removal
- Install URL hijack opens addonup.com on install
- Free webmail developer (gmail) with no verified business website
- jquery@2.2.4 contains 4 medium-severity XSS CVEs
- CSP allows 'unsafe-eval' with DOM XSS sink present
Evidence
- uninstall_url_hijack store chrome.runtime.setUninstallURL() targets addonup.com
- install_url_hijack store onInstalled opens addonup.com/extensions
- free_webmail_developer store Developer email exttoolscmp@gmail.com uses free webmail
- featured_by_google store Extension is featured by Google
- cve_multiple_medium crx jquery@2.2.4 has 4 medium-severity XSS CVEs, fixed in >=3.4.0
- dom_sink_innerhtml crx innerHTML assignment from variable in kofi-overlay-widget.js
- csp_unsafe_eval manifest CSP script-src includes 'unsafe-eval'
- privacy_adequate api Privacy policy fetched, scoped, discloses collection and retention
CVE Exposures (4)
| CVE | Library | Severity | Fixed in | Summary |
|---|---|---|---|---|
| CVE-2019-11358 | jquery@2.2.4 | medium | 3.4.0 | XSS in jQuery as used in Drupal, Backdrop CMS, and other products |
| CVE-2020-11022 | jquery@2.2.4 | medium | 3.5.0 | Potential XSS vulnerability in jQuery |
| CVE-2020-11023 | jquery@2.2.4 | medium | 3.5.0 | Potential XSS vulnerability in jQuery |
| CVE-2015-9251 | jquery@2.2.4 | medium | 1.12.2 | Cross-Site Scripting (XSS) in jquery |
Permissions Breakdown
- tabCapture high Access to capture audio/video content of browser tabs, high sensitivity.
- storage low Local storage for settings, low risk.
- tabs medium Access to tab URLs and metadata.
Pillar Scores
Permissions2.00
Reputation6.50
Network4.50
Webstore7.00
Maintenance0.00
Privacy0.00
Code Quality4.00
CVE Exposure6.50
Bookkeeping
Rubric v3.6
Scored at 2026-09-23 06:10
Listing SHA
ba07ced67740…
Force block
— not fired
Score recovered
no
Elapsed
—