Top Risks

• underscore@1.8.3 bundles critical CVE-2021-23358 (arbitrary code execution) and high CVE-2026-27601 (DoS); not patched.
• broad host access (http://*/* + https://*/*) combined with scripting and webRequest enables full page read/modify on every site.
• new Function() constructor in background.js and innerHTML sinks in growthbook.js/react-dom create code-execution surface.
• Privacy policy discloses third-party data sharing; scoped but extension collects browsing data on all visited URLs.
• bit.ly affiliate/cloaking redirector present in js_external_hosts — obfuscates final redirect destination.

Evidence

• critical_cve_bundled_lib crx underscore@1.8.3 has CVE-2021-23358 (ACE, critical); fixed in 1.12.1 — still at 1.8.3.
• high_cve_bundled_lib crx underscore@1.8.3 has CVE-2026-27601 (DoS, high); fixed in 1.13.8.
• broad_host_permissions manifest host_permissions include http://*/* and https://*/* plus content_scripts on *://*/*. Full site access.
• function_constructor crx new Function('return this') in background.js — dynamic code construction path.
• dom_xss_sink crx innerHTML assignment in growthbook.js and react-dom.min.js; csp_present but unsafe-inline on style-src only.
• affiliate_hit crx bit.ly in js_external_hosts — generic short-link/affiliate cloaking redirector.
• verified_publisher_featured store Extension is verified publisher AND featured by Google; domain mywot.com resolves; email on same domain.
• third_party_sharing_disclosed api Privacy policy fetched; scope_extension=true, retention=true, third_party_sharing=true — disclosed but present.

CVE Exposures (2)

Permissions Breakdown

• tabs medium Access to tab URLs and metadata; needed for site-rating overlays.
• contextMenus low Adds right-click menu items; low standalone risk.
• webNavigation medium Tracks navigation events across all sites; broad reach.
• webRequest high Observe all HTTP requests across http://*/* and https://*/*.
• declarativeNetRequest medium Rule-based request blocking; expected for security tool.
• declarativeNetRequestFeedback medium Read matched blocking rules; low additional risk.
• storage low Local extension data storage; standard.
• scripting high Programmatic script injection into pages; paired with broad host permissions.
• alarms low Scheduled background tasks; low risk.
• http://www.mywot.com/* low Dev-owned domain; scoped host access.
• http://api.mywot.com/* low Dev-owned API domain; scoped.
• https://api.mywot.com/* low Dev-owned API domain; scoped.
• http://*/* high Full HTTP host access — all sites.
• https://*/* high Full HTTPS host access — all sites.

Pillar Scores

Bookkeeping