Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 (ACE); unfixed version in content script on all pages.
• Privacy policy fetched but scope_extension=false AND admits data collection + 3rd-party sharing → +10.0 privacy pillar.
• Dynamic <script> creation in 5 JS files raises code injection risk given broad <all_urls> host permissions.
• Broad content-script host permissions (all HTTP/HTTPS/file) combined with scripting give full page-read/write across every site.
• CSP connect-src allows 'http: https: wss:' broadly; 12 external hosts including raw.githubusercontent.com and multiple S3 buckets.

Evidence

• cve_critical crx underscore@1.8.3 has CVE-2021-23358 (ACE, critical); fixed in 1.12.1; used in contentscript.
• cve_high crx underscore@1.8.3 has CVE-2026-27601 (DoS, high); fixed in 1.13.8.
• privacy_policy_scope_fail api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → D clause +10.0.
• script_src_dynamic crx 5 JS files create dynamic <script> elements via webpack runtime; combined with <all_urls> host_permissions.
• broad_host_permissions manifest host_permissions and content_scripts_matches both include file://*/* http://*/* https://*/*.
• csp_connect_broad manifest CSP connect-src allows 'http: https: wss:' — essentially unrestricted outbound connections.
• developer_name_missing store developer_name is empty string; only email wallet@avalabs.org available; no verified publisher badge.
• geo_diversity crx JS hosts span 4 countries (CA, FR, IN, US) including raw.githubusercontent.com and multiple warden S3 buckets.

CVE Exposures (2)

Permissions Breakdown

• storage low Standard key-value persistence for wallet state.
• unlimitedStorage low Needed for blockchain data cache; low standalone risk.
• activeTab low Grants access to current tab on user gesture only.
• contextMenus low UI surface only; no data exfil path.
• notifications low Transaction alerts; no read access to user data.
• scripting medium Can inject JS into pages; elevated risk with broad host_permissions.
• identity low OAuth token access; no scopes specified.
• alarms low Periodic background tasks; low risk alone.
• offscreen low Off-screen document for crypto ops; low risk.
• sidePanel low UI panel only.
• file://*/* high Content script on local files; unusual for a wallet.
• http://*/* high Broad host permission; content script on all HTTP sites.
• https://*/* high Broad host permission; content script on all HTTPS sites.

Pillar Scores

Bookkeeping