Top Risks

• Uninstall and install URL hijack flagged — redirects on install/uninstall events to internal/external pages.
• Privacy policy on CDN subdomain (cdn.cloudapi.stream), not scoped to this extension; third-party sharing admitted without data collection disclosure.
• jquery@3.2.1 bundles 3 medium CVEs (XSS) unfixed; library below 3.5.0 threshold.
• Free-webmail developer (gmail), no developer name, no verified publisher — low accountability.
• Sandbox CSP allows unsafe-inline and unsafe-eval, weakening in-extension sandbox security.

Evidence

• install_url_hijack crx onInstalled opens popup/index.html — install_url_hijack flagged true.
• uninstall_url_hijack crx uninstall_url_hijack flagged true; target null but hook present.
• jquery_cve crx jquery@3.2.1 has 3 medium CVEs: CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; fixed_in 3.5.0.
• privacy_policy_unscoped store Policy fetched from cdn.cloudapi.stream; scope_extension=false, data_collection=false, third_party_sharing=true.
• developer_identity store Developer email is free-webmail gmail.com; no developer name; no verified publisher badge.
• sandbox_csp_weak crx Sandbox CSP allows unsafe-inline and unsafe-eval on script-src, weakening sandbox isolation.
• js_external_hosts crx 10 external JS hosts referenced: bnjmnt4n.now.sh, cloudapi.stream, createjs.com, github.com, goo.gl, others.
• no_permissions crx No declared permissions or host_permissions — extension is a self-contained game with no browser API access.

CVE Exposures (3)

Pillar Scores

Bookkeeping