Top Risks

• Uninstall and install URL hijack both active — onInstalled opens popup/index.html and uninstall hook fires, unusual for a game extension.
• Privacy policy fetched but scope_extension=false with third_party_sharing=true: generic CDN-hosted policy admits data sharing without scoping to this extension.
• Three medium-severity jQuery CVEs (3.1.1 and 3.2.1 bundled): XSS risk from outdated libraries, none upgraded to fixed_in versions.
• Free-webmail Gmail developer with no verified publisher badge; accountability is minimal.
• 12 distinct external JS host references in source files spanning multiple jurisdictions (CA, NL, US).

Evidence

• install_url_hijack crx install_url_hijack=true; target=popup/index.html. onInstalled redirect to own popup is unusual for a card game.
• uninstall_url_hijack crx uninstall_url_hijack=true; target=null. Uninstall hook present with no visible target — masked destination.
• privacy_policy_generic store Policy at cdn.cloudapi.stream: scope_extension=false, third_party_sharing=true. CDN-hosted generic policy admitting 3rd-party sharing.
• cve_medium_jquery crx jquery 3.1.1 and 3.2.1 bundled with 3 medium CVEs each (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed_in 3.5.0.
• free_webmail_developer store Developer email kiev3381917@gmail.com; no verified publisher badge; no business domain.
• sandbox_unsafe_eval crx sandbox CSP allows unsafe-inline and unsafe-eval on script-src; elevated risk for sandboxed pages.
• external_js_hosts crx 12 distinct external JS host references including bnjmnt4n.now.sh, cloudapi.stream, codecanyon.net, createjs.com, goo.gl.
• webstore_install_count_low store Only 178 installs; low reach reduces blast radius but not per-user risk.

CVE Exposures (6)

Pillar Scores

Bookkeeping