Top Risks

• Critical CVE in bundled underscore@1.8.3 (CVE-2021-23358: Arbitrary Code Execution); not patched.
• Privacy policy points to Google's own policy (myaccount.google.com) — not scoped to this extension at all.
• Brand impersonation: extension name uses 'Netflix' and 'YouTube' but developer is not a confirmed owner.
• 12 distinct external JS hosts including funfluen.com subdomains; broad network surface for language app.
• No developer name listed in store; increases accountability gap despite verified publisher badge.

Evidence

• critical_cve_underscore crx underscore@1.8.3 has CVE-2021-23358 (critical, ACE) and CVE-2026-27601 (high, DoS); fixed_in 1.12.1/1.13.8.
• privacy_policy_not_scoped store Privacy policy URL is Google's generic account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brands_mentioned=[youtube,netflix], confirmed_owner=false, is_impersonation=true per brand_mention.
• broad_external_hosts crx 12 external JS hosts: appforlanguage.com subdomains + funfluen.com subdomains + fb.me + github.com.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; partially mitigates reputation concerns.
• no_developer_name store developer_name is empty string; reduces accountability despite having developer email.
• react_16_13_1_bundled crx react@16.13.1 bundled; below 18.x but no CVE flagged; CSP present (self-only) mitigates XSS risk.
• content_scripts_payment_gateway crx Content scripts run on appforlanguage.com payment-gateway paths; could access payment page DOM.

CVE Exposures (2)

Permissions Breakdown

• storage low Stores user preferences/state locally; minimal risk.
• tts low Text-to-speech for language learning; fits stated function.
• https://appforlanguage.com/* low Developer's own domain; payment gateway content scripts.
• https://clients5.google.com/* low Google API endpoint; narrow scope.
• *://youtube.com/* medium Broad access to YouTube; justified by stated language-learning function.
• *://netflix.com/* medium Broad access to Netflix; justified by stated language-learning function.

Pillar Scores

Bookkeeping