Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Rugby Rush + malext.io malicious_extension_sentry (+2.5, capped).
• jQuery 3.2.1 bundled with 3 medium-severity CVEs (XSS); fixed_in 3.5.0 not applied.
• Privacy policy hosted on CDN subdomain (cdn.cloudapi.stream), not scoped to this extension; third_party_sharing admitted.
• Developer uses free Gmail address with no verified business identity.
• Sandbox CSP allows unsafe-inline and unsafe-eval on sandboxed pages.

Evidence

• jquery_cve crx jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed in 3.5.0.
• privacy_policy_unscoped store Policy fetched but scope_extension=false, data_collection=false, third_party_sharing=true → +9.0 privacy.
• free_webmail_dev store Developer email kiev3381917@gmail.com; no verified publisher; no business website.
• sandbox_csp_unsafe manifest sandbox CSP includes unsafe-inline and unsafe-eval on script-src.
• no_permissions manifest Zero declared permissions, host_permissions, and content_scripts — very low capability surface.
• maintenance_3_6mo store Last updated April 2026; months_since_update=5 → +1.5 maintenance.
• low_installs store Only 410 installs; no install-count amplifiers triggered.
• no_bad_hosts api threat_intel bad_host_hits, monetization_hits, and affiliate_hits all empty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Rugby Rush + malext.io malicious_extension_sentry; score 3.27 -> 5.77 (+2.5 cap 2.5).

CVE Exposures (3)

Pillar Scores

Bookkeeping