Top Risks

• jquery@3.2.1 bundles 3 moderate XSS CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); not fixed until 3.5.0.
• Broad host_permissions *://*/* + scripting allows script injection into every site visited.
• Free-webmail developer (stiglebungpo@gmail.com) with no verified publisher badge; unverifiable identity.
• Privacy policy hosted on free Google Sites with no retention disclosure; third_party_silence=true.
• install_url_hijack opens internal editor page on install; minor but indicates install-time navigation control.

Evidence

• broad_host_permissions manifest host_permissions=[*://*/*] + scripting permission enables injection on all sites.
• cve_moderate_x3 crx jquery@3.2.1 has CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; fixed in 3.5.0.
• free_webmail_dev store Developer email stiglebungpo@gmail.com; no verified publisher; no business domain.
• privacy_policy_free_hosting api Policy on sites.google.com; scope_extension=true but retention=false; third_party_silence=true.
• install_url_hijack manifest install_url_target='/html/editor.html'; opens page on install (internal, not 3rd party).
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit CSP declared.
• is_featured_by_google store Extension carries Google Featured badge, providing partial trust signal.
• no_obfuscation_no_code_findings crx obfuscation_score=0.0; code_findings_raw=[]; clean code scan apart from vulnerable jQuery.

CVE Exposures (3)

Permissions Breakdown

• activeTab low Scoped to user-activated tab; limited blast radius.
• storage low Local data persistence; no cross-origin capability.
• scripting high Enables script injection into pages; combined with *://*/* elevates risk.
• *://*/* high Broad host access across all URLs; paired with scripting creates wide attack surface.

Pillar Scores

Bookkeeping