Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 enables arbitrary code execution; not patched to fixed_in 1.12.1.
• No CSP + underscore (DOM-manipulation lib) with high/critical CVE triggers CVE v2 amplifier (×1.5), CVE pillar=7.5.
• Privacy policy admits data_collection=true and third_party_sharing=true without scoping to this extension → Privacy pillar=10.
• scripting + <all_urls> with no CSP allows content injection on every site; new Function() constructor present in injected script.
• Extension stale 25 months, MV3 but unfixed critical/high CVEs; v2 triple-stale fingerprint (>24mo + CVEs) adds Webstore risk.

Evidence

• critical_cve_bundled_lib crx underscore@1.8.3 bundles CVE-2021-23358 (critical, ACE); fixed_in 1.12.1 — library not updated.
• high_cve_bundled_lib crx underscore@1.8.3 also carries CVE-2026-27601 (high, DoS via recursion); fixed_in 1.13.8.
• no_csp_with_critical_cve crx content_security_policy is null; CVE v2 amplifier ×1.5 applies — underscore is a DOM-manipulation lib.
• privacy_policy_generic_with_sharing api Policy scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D: +10.0.
• function_constructor_in_content_script crx new Function() constructor found in js/content-script-combo.js injected on all URLs.
• stale_extension_with_cves store 25 months since last update; v2 calibration triple-stale (>24mo + CVEs + MV3) adds Webstore +2.0.
• broad_host_plus_scripting manifest <all_urls> host permission paired with scripting; DeveloperTools discount applied (-1.5).
• geo_diversity_3_countries crx JS hosts span IN, SG, US (3 countries); below threshold of 4 — no geo-diversity penalty.

CVE Exposures (2)

Permissions Breakdown

• tabs medium Access to tab URLs and metadata; medium risk for a color picker.
• scripting high Programmatic script injection into pages; elevated with <all_urls>.
• storage low Local data persistence; standard for storing color history.
• offscreen low Off-screen document; low risk, used for background rendering.
• <all_urls> high Broad host access paired with scripting allows injection on every site visited.

Pillar Scores

Bookkeeping