Top Risks

• Privacy policy not scoped to this extension; fetched but declares third-party sharing without extension context.
• jQuery 3.2.1 bundled with 3 medium-severity CVEs (XSS); unfixed below 3.5.0.
• Developer uses free Gmail account with no verified business identity.
• Sandbox CSP allows unsafe-inline and unsafe-eval, increasing XSS risk if sandbox content processes untrusted data.
• 12 external JS hosts referenced in code — broad external surface for a simple game extension.

Evidence

• free_webmail_dev store Developer email kiev3381917@gmail.com is free webmail with no verified business website.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false, third_party_sharing=true — generic, not extension-scoped.
• cve_medium_jquery crx jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed in 3.5.0.
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src, widening XSS attack surface.
• external_js_hosts crx 12 distinct external JS hosts including bnjmnt4n.now.sh, topup.cloudapi.stream, goo.gl — broad for a game.
• host_permissions_dev_cdn manifest Host permissions include wheel.cloudapi.stream and mines.cloudapi.stream — dev-controlled but unverified CDN.
• no_verified_publisher store No verified publisher badge; not featured by Google; 409 installs only.
• obfuscation_clean crx obfuscation_score=0.0; no code_findings_raw signals; code appears clean beyond CVE-affected library.

CVE Exposures (3)

Permissions Breakdown

• https://www.googleapis.com/* low Scoped host permission to Google APIs; limited surface.
• https://wheel.cloudapi.stream/* medium Scoped to dev-controlled CDN subdomain; could receive game data or tracking.
• https://mines.cloudapi.stream/* medium Scoped to dev-controlled CDN subdomain; same risk as wheel subdomain.

Pillar Scores

Bookkeeping