Top Risks

• proxy + <all_urls>: can silently redirect all browser traffic through attacker-controlled server
• 46 months abandoned; no security patches; three medium CVEs in bundled jquery@1.9.1
• Privacy policy on free Google Sites host, admits data collection + third-party sharing, unscoped to extension
• Free-webmail Gmail developer with no verified publisher status; uninstall URL hijack present
• No CSP + jquery@1.9.1 with XSS CVEs increases DOM-sink exploitation surface

Evidence

• proxy + broad host permissions manifest proxy permission + *://*/* + <all_urls>: full traffic interception capability on every site.
• abandoned extension store Last updated October 2022; 46 months since update — well beyond >36mo worst-band threshold.
• jquery@1.9.1 with 3 medium CVEs crx CVE-2015-9251, CVE-2019-11358, CVE-2020-11023 unfixed; fixed_in 3.5.0, bundled 1.9.1.
• no CSP + vulnerable jquery crx csp_present=false with jquery@1.9.1 XSS CVEs; v2e jquery@<3.5 + no CSP combo applies (+2.0 CQ).
• uninstall URL hijack crx uninstall_url_hijack=true; extension registers a third-party uninstall redirect.
• privacy policy inadequate api Hosted on free Google Sites; scope_extension=false, data_collection=true, third_party_sharing=true → D-rule +10.
• free-webmail developer store Developer email steven.digitaldream@gmail.com; no verified publisher; reputation floor 7.5 applies.
• low rating store Rating 1.7 — below 3.0 threshold; signals user-reported problems.

CVE Exposures (3)

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• unlimitedStorage low Allows large local storage; minor risk alone.
• proxy high Can redirect all browser traffic through arbitrary proxy servers; critical for VPN but high abuse potential.
• *://*/* high Broad host access covering all URLs; paired with proxy creates full traffic interception capability.
• <all_urls> high Redundant with *://*/* — reinforces total URL coverage. Counts once at higher value.

Pillar Scores

Bookkeeping