Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Time & Date Extension [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Critical CVE-2021-23358 (Arbitrary Code Execution) in bundled underscore@1.8.3, unfixed version shipped in extension.
• High CVE-2026-27601 in underscore@1.8.3 enabling DoS via unbounded recursion.
• Privacy policy is Google's own account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• 4086 JS files bundled (likely entire node_modules tree); massive unexplained attack surface for a simple time/date widget.

Evidence

• cve_critical crx underscore@1.8.3 has CVE-2021-23358 (critical, ACE); fixed_in 1.12.1 — shipped version is vulnerable.
• cve_high crx underscore@1.8.3 has CVE-2026-27601 (high, DoS); fixed_in 1.13.8 — shipped version is vulnerable.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10 privacy.
• js_file_count_anomaly crx 4086 JS files in a time/date extension — entire node_modules tree bundled, massively exceeds expected surface.
• free_webmail_dev store Developer email gamithchanuka123@gmail.com; no verified publisher, no business domain.
• function_constructor_in_node_modules crx Multiple new Function() calls in ajv/js-yaml bundled libs; eval_user_input in jsdom — all in node_modules paths.
• external_js_hosts crx 12 external JS host references (babeljs.io, raw.githubusercontent.com, stackoverflow.com etc.) in bundled source maps.
• csp_present_mv3 manifest CSP script-src 'self'; object-src 'self' — strict, no remote loading. MV3. No network penalty.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Time & Date Extension [browser-hijack] + malext.io malicious_extension_sentry; score 2.75 -> 5.25 (+2.5 cap 2.5).

CVE Exposures (2)

Permissions Breakdown

• storage low Stores extension preferences locally; low risk.
• alarms low Schedules periodic tasks; expected for time/date widget.
• notifications low Sends desktop notifications; moderate nuisance potential only.
• https://api.weatherapi.com/* low Scoped host permission to weather API; matches stated functionality.

Pillar Scores

Bookkeeping