Top Risks

• Privacy policy URL unfetchable (HTTP error) — no verifiable data-handling disclosure; treated as no policy.
• jQuery 1.9.1 bundled with 3 medium CVEs (XSS); no CSP amplifies exploitability on FB/TikTok/Twitter pages.
• last_updated missing — maintenance unknown; stale fingerprint with CVEs scores max maintenance penalty.
• webRequest + broad social-platform host permissions (FB, Twitter, TikTok) enable passive session surveillance.
• Brand impersonation: Facebook™ trademark in name; developer is not a confirmed Facebook owner.

Evidence

• privacy_policy_unfetchable api privacy_policy_classification.fetched==false (fetch_error:HTTPError); scored as no policy (+10.0 privacy).
• cve_jquery_1.9.1_3x_medium crx CVE-2015-9251, CVE-2019-11358, CVE-2020-11023 in jquery@1.9.1; no CSP present; ×1.5 CVE amplifier applied.
• no_csp_mv3 manifest content_security_policy is null; no CSP boosts CVE XSS risk and jquery+no-CSP code quality penalty.
• last_updated_missing store months_since_update is null; treated as >36 months for maintenance pillar (max score 10.0).
• brand_impersonation_facebook store brand_mention.is_impersonation==true; confirmed_owner==false; Facebook™ trademark in title.
• webrequest_broad_social_hosts manifest webRequest declared; host_permissions cover facebook.com, twitter.com, x.com, tiktok.com.
• install_url_hijack crx install_url_hijack==true; onInstalled opens external URL (target null but flag set).
• no_developer_name store developer_name is empty string; reduces accountability.

CVE Exposures (3)

Permissions Breakdown

• activeTab low Scoped to current tab on user interaction only.
• identity medium Can access OAuth identity tokens.
• identity.email medium Reads the user's Google account email address.
• storage low Local extension storage, low direct risk.
• webRequest high Can observe all network requests on permitted hosts including FB/TikTok/Twitter.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• declarativeNetRequestFeedback medium Can read which declarative rules fired, leaking browsing metadata.
• host: facebook.com/* high Full access to FB page content — credentials, messages, session tokens.
• host: twitter.com/* / x.com/* high Full access to Twitter/X — broad social-platform reach.
• host: tiktok.com/* high Full access to TikTok pages.
• host: socialerase.net/* medium Developer-controlled backend; content-script + XHR to this host.
• host: googleapis.com/* medium Google API calls, likely for identity/OAuth flow.

Pillar Scores

Bookkeeping