Top Risks

• Uninstall and install URL hijack both present — tracks install/uninstall lifecycle via external URL.
• Privacy policy on CDN domain (cloudapi.stream) not scoped to this extension; third-party sharing admitted without scope.
• Bundled jquery@2.0.3 and jquery@3.2.1 carry 7 moderate-severity CVEs (XSS); neither version meets fixed_in threshold.
• Free-webmail dev (nadejdinv@gmail.com), no developer name, no verified publisher — unverifiable identity.
• Sandbox CSP allows unsafe-eval and unsafe-inline; 11 external JS hosts referenced in source files.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled and uninstall URL hooks present; install_url_target=popup/index.html, uninstall_url_target=null.
• free_webmail_no_dev_name store Developer email nadejdinv@gmail.com, developer_name empty, no verified publisher badge.
• privacy_policy_not_scoped api Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true.
• cve_moderate_bundled_jquery crx jquery@2.0.3 (4 CVEs) and jquery@3.2.1 (3 CVEs); all moderate XSS; unfixed versions bundled.
• sandbox_csp_unsafe_eval manifest Sandbox CSP includes unsafe-eval and unsafe-inline on script-src.
• external_js_hosts crx 11 external hosts in JS files including cloudapi.stream, codecanyon.net, createjs.com, goo.gl.
• BOM_chars_in_title store Title contains double BOM (\uFEFF\uFEFF) — suspicious encoding artifact common in low-quality submissions.
• manifest_name_i18n_placeholder manifest manifest_name=__MSG_name__ and manifest_description=__MSG_desc__ — unresolved i18n placeholders.

CVE Exposures (7)

Pillar Scores

Bookkeeping