Top Risks

• Privacy policy URL returns fetch error — policy cannot be verified; treated as no policy (+10.0 privacy).
• Code quality at threshold: script_src_dynamic (×4 files) + innerHTML sinks with no CSP raises DOM-XSS and remote-script risk.
• Extension not updated in 28 months; stale codebase increases risk of unpatched vulnerabilities.
• Uninstall URL hijack to catchhotels.com and install URL hijack; webstore signal for monetization pattern.
• Content script runs on all booking.com pages, able to read user booking/payment context with no CSP guard.

Evidence

• privacy_policy_fetch_failed api Privacy policy at catchhotels.com/privacy returned fetch_error:HTTPError — treated as unfetched (+10.0 privacy pillar).
• script_src_dynamic_multiple_files crx Dynamic script creation found in 4 JS files including content scripts on booking.com pages; no CSP present.
• dom_sink_innerhtml crx innerHTML assignments from variables in 2 files; DOM-XSS risk elevated by absent CSP (+2.0 code quality fix B).
• uninstall_and_install_url_hijack manifest Both onInstalled and uninstall redirect to catchhotels.com domain — monetization/retention pattern (+2.0 webstore).
• stale_extension store 28 months since last update — maintenance score 8.5; stale codebase with no CSP increases attack surface.
• no_developer_name store Developer name field is empty; reputation start remains at 5.0 with +1.0 penalty applied.
• verified_publisher store Verified publisher badge present (-3.0 reputation); domain resolves, not throwaway, not new.
• google_analytics_telemetry crx monetization_hits contains google-analytics.com (telemetry tier only); +1.0 webstore signal applied.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• offscreen low Offscreen document for background tasks; low risk on its own.
• https://www.google-analytics.com/* low Scoped to known telemetry provider; limited blast radius.
• https://extension-api.catchhotels.com/* low Dev-controlled API endpoint; scoped host permission.
• content_scripts: https://*.booking.com/* medium Runs JS in booking.com pages; can read/modify booking page content and user data.

Pillar Scores

Bookkeeping