Top Risks

• Privacy policy is Google's generic policy; not scoped to this extension — admits data collection and 3rd-party sharing.
• Free-webmail developer (gmail) with no verified business; numbered-alias pattern (mildred567guy).
• Five medium-severity jQuery CVEs (XSS) in bundled libs below fixed_in version, no CSP amplifies risk.
• install_url_hijack opens 3rd-party URL on install; external JS host sound-pro.net unverified.
• Content scripts injected on <all_urls> combined with tabCapture creates broad audio/page capture surface.

Evidence

• free_webmail_developer store Developer email mildred567guy@gmail.com — free webmail, numbered alias, no business domain.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• install_url_hijack manifest install_url_hijack=true; extension opens 3rd-party URL on install (target undisclosed).
• external_js_host crx js_external_hosts: ['sound-pro.net'] — unverified external domain serves JS.
• cve_jquery_xss crx 5 medium CVEs across jquery@3.4.1 and 3.2.1 (CVE-2020-11022/23, CVE-2019-11358); not fixed.
• no_csp manifest csp_present=false; MV3 default applies but no explicit CSP; amplifies jQuery XSS risk.
• host_permissions_all_urls manifest <all_urls> host permission + content_scripts on all URLs; broad page access.
• is_featured_by_google store Extension carries Google Featured badge, partially offsetting reputation concerns.

CVE Exposures (5)

Permissions Breakdown

• tabCapture high Captures audio/video from active tabs; core to stated function but high-capability.
• offscreen medium Enables background document for audio processing; out-of-view execution surface.
• storage low Local settings persistence; standard low-risk permission.
• <all_urls> (host) high Content scripts injected into every page; broad reach paired with tabCapture.

Pillar Scores

Bookkeeping