Top Risks

• Privacy policy admits data collection + 3rd-party sharing without extension scope
• Critical CVE-2021-23358 (RCE) in bundled underscore@1.8.3, unfixed
• High CVE-2026-27601 DoS in same outdated underscore build
• Content scripts on *://*/* expose all sites to wallet code
• Dynamic script-src creation and Function constructor in JS

Evidence

• privacy_policy api Fetched policy: scope_extension=false, data_collection=true, third_party_sharing=true (v3.5 D: +10)
• cve_critical api underscore@1.8.3 bundles CVE-2021-23358 (critical RCE), fixed in 1.12.1
• cve_high api underscore@1.8.3 also carries CVE-2026-27601 (high DoS), fixed in 1.13.8
• code_function_ctor crx new Function() constructor in neonjs bundle (+2.5 code quality)
• code_dynamic_script crx Dynamic <script src> creation in runtime bundle (+3.0 code quality)
• verified_publisher store Verified publisher; domain neonext.io resolves; reputation floor 2.0
• broad_content_scripts manifest content_scripts matches *://*/* despite only low-tier permissions
• wallet_network manifest Hosts are NEO blockchain seeds/rpc (neo.org, ngd.network) - expected for wallet category

CVE Exposures (2)

Permissions Breakdown

• storage low Standard local storage; benign.
• notifications low No host access; low risk.
• activeTab low User-gated tab access; low.
• alarms low Scheduling only; benign.
• content_scripts *://*/* high Broad content-script host access across all sites.

Pillar Scores

Bookkeeping