Top Risks

• Outdated jQuery 3.1.1 bundles 3 medium CVEs (XSS); no CSP amplifies exploitability.
• Privacy policy admits data collection and third-party sharing without retention disclosure.
• Extension last updated 13 months ago; CVEs remain unpatched.
• No developer display name; no rating count data to assess review quality.
• innerHTML sinks in popup.js and bundled jQuery without CSP protection.

Evidence

• cve_jquery_medium_x3 crx jquery@3.1.1 bundles CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; all fixed in 3.5.0.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• dom_sink_innerhtml crx Two innerHTML sinks found: js/popup.js and jquery.js; no CSP to mitigate XSS.
• stale_13mo store Last updated May 2025; 13 months since update with unpatched CVEs.
• verified_publisher_featured store Extension is verified publisher and featured by Google; reduces reputation risk.
• no_bad_hosts_no_affiliates api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits.
• no_developer_name store developer_name is empty string; reduces accountability signal.

CVE Exposures (3)

Permissions Breakdown

• tts low Text-to-speech synthesis; core stated function.
• ttsEngine low Registers a TTS engine; core stated function.
• activeTab medium Grants access to the active tab on user action; limited scope.
• scripting medium Can inject scripts into active tab; needed for TTS text extraction.
• contextMenus low Adds right-click menu items; low risk.
• storage low Local settings storage; low risk.
• offscreen low Offscreen document for audio processing; low risk.

Pillar Scores

Bookkeeping