Top Risks

• Google brand impersonation in title by unverified gmail developer with no dev name
• Privacy policy URL fetch failed (retrobowl.me unrelated domain) — treated as no policy
• 4 medium-severity jQuery CVEs (v2.1.3) with no CSP, unfixed for 2+ years
• install_url_hijack AND uninstall_url_hijack flags set; uninstall URL redirects to 3rd party
• Extension stale 25 months; description_promise.is_shell_pattern == true

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer_email is gmail, confirmed_owner=false
• privacy_policy_fetch_failed crx privacy_policy_classification.fetched=false (fetch_error:HTTPError); retrobowl.me is unrelated domain
• jquery_cves crx jquery@2.1.3 has 4 moderate CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023, CVE-2015-9251); no CSP
• install_uninstall_url_hijack crx install_url_hijack=true AND uninstall_url_hijack=true; targets null but flags are authoritative
• shell_pattern store description_promise.is_shell_pattern=true; play_or_open promise with no substantive permissions
• stale_extension store months_since_update=25; last_updated May 2024; 90k installs still active
• free_webmail_no_dev_name store developer_name=''; developer_email=fugiman20@gmail.com; no business website
• external_hosts crx js_external_hosts: raw.githubusercontent.com, www.w3technic.com — 2 distinct external JS origins

CVE Exposures (4)

Pillar Scores

Bookkeeping