Top Risks

• Abandoned 43 months; unpatched jquery@3.2.1 with 3 medium XSS CVEs on all sites
• Uninstall URL hijack: setUninstallURL() points to a third party
• Install URL hijack: onInstalled opens a third-party URL
• Free-gmail developer with no business site; broad *://*/* content-script access
• Rating 3.8 with no publisher verification

Evidence

• broad_host_access crx host_permissions and content_scripts on *://*/*; scripting permission declared
• abandoned store Last updated March 26, 2023 (43 months ago)
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() to 3rd party detected
• install_url_hijack crx onInstalled opens 3rd-party URL
• vulnerable_dependency crx jquery@3.2.1 bundled; CVE-2019-11358, CVE-2020-11022/11023; no CSP set
• dev_identity store Free gmail dev martinneeshamrt; not verified; featured badge present
• privacy_policy api Google Sites policy, extension-scoped, no retention disclosed, silent on 3rd parties
• code_scan_clean crx No code findings; obfuscation_score 0.0; 5 JS files scanned

CVE Exposures (3)

Permissions Breakdown

• scripting medium Programmatic injection into pages; pairs with broad host access
• storage low Local settings storage
• unlimitedStorage low Unbounded local storage quota
• activeTab low Temporary access to active tab on user gesture
• host_permissions:*://*/* high Broad host access on all sites via host_permissions and content_scripts

Pillar Scores

Bookkeeping