Top Risks

• Brand impersonation: uses eBay™ trademark without verified ownership; gmail dev with no business domain.
• content_scripts on <all_urls> despite eBay-only stated purpose — injected on every site visited.
• jQuery 1.11.1 bundles 3 moderate CVEs (XSS); no CSP present amplifies exploitability (×1.5).
• Privacy policy hosted on unrelated findniche.com domain; collects data + third-party sharing, no retention.
• Extension stale 17 months with no CSP and vulnerable jQuery; v2 calibration cap applied to discounts.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; eBay mentioned, confirmed_owner=false, dev domain is gmail.com.
• content_scripts_all_urls_mismatch manifest content_scripts_matches=[<all_urls>] but extension targets eBay only; scope mismatch +1.0 perm.
• jquery_cve_cluster crx jquery@1.11.1 has 3 moderate CVEs (CVE-2015-9251, CVE-2019-11358, CVE-2020-11023); no CSP amplifier ×1.5.
• no_csp manifest csp_present=false; v2 fix (b) does NOT add +2.0 for MV3, but CVE amplifier ×1.5 applies.
• script_src_dynamic crx code_findings_raw: script_src_dynamic in jquery.js — dynamic script element creation.
• privacy_policy_mismatched_domain store Privacy URL is findniche.com/privacy; data_collection=true, third_party_sharing=true, retention=false.
• free_webmail_developer store developer_email=wuhenlove1993@gmail.com; no verified business; reputation floor 7.5 applied.
• stale_extension store months_since_update=17; 12-24mo band → maintenance +6.0.

CVE Exposures (3)

Permissions Breakdown

• storage low Stores local settings; low standalone risk.
• tabs medium Can read tab URLs; moderate risk for navigation tracking.
• content_scripts <all_urls> high Injects JS on every site despite stated eBay-only purpose; scope mismatch.

Pillar Scores

Bookkeeping