Top Risks

• Google generic privacy policy used — scope_extension=false, admits data collection and 3rd-party sharing unscoped to this extension → privacy pillar maxed.
• browsingData + broad host permissions (http://*/* + https://*/*) allow clearing user cookies/cache across all sites.
• importScripts loading remote Firebase URL at runtime — remote code execution surface in service worker.
• jquery@3.3.1 bundled with 3 moderate CVEs (XSS); no CSP present amplifying DOM-XSS risk.
• Free-webmail dev (gmail), no developer name, low 2.0 rating; developer accountability is minimal.

Evidence

• broad_host_permissions manifest http://*/* and https://*/* grant access to every site visited, combined with scripting and browsingData.
• browsingData_permission manifest browsingData allows clearing cookies, history, cache — high-impact destructive capability.
• import_scripts_remote crx firebase-messaging-sw.js calls importScripts('https://www.gstatic.com/firebasejs/7.14.0/firebase...') — remote code load.
• generic_google_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• jquery_cve_trio crx jquery@3.3.1 has CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all moderate XSS); fixed in 3.5.0.
• no_csp manifest csp_present=false on MV3 extension with DOM-XSS sinks and vulnerable jquery amplifies CVE risk.
• developer_identity store Developer email is free webmail (gmail.com), no developer name listed, rating 2.0.
• dom_xss_sinks crx 3 innerHTML assignments from variables found across app736e75726620636f7270.js, smph.js, fontawesome all.min.js.

CVE Exposures (3)

Permissions Breakdown

• scripting medium Can inject JS into pages; combined with broad host access this is high-capability.
• declarativeNetRequest medium Can block/redirect network requests across all sites.
• browsingData high Can clear cookies, cache, history — destructive and privacy-invasive.
• background low Keeps service worker alive; minimal standalone risk.
• activeTab low Access to currently active tab only; narrow scope.
• http://*/* high Broad host access over HTTP to all sites.
• https://*/* high Broad host access over HTTPS to all sites.

Pillar Scores

Bookkeeping