Top Risks

• Privacy policy fetched but does not scope to this extension, admits data collection and third-party sharing — scores maximum privacy risk.
• Bundled jQuery 1.9.1 carries 3 medium CVEs (XSS); no CSP amplifies exploitability via scripting permission.
• Developer uses free Gmail address with no verified business identity; accountability is minimal.
• Privacy policy hosted on Bitbucket free hosting; lacks retention disclosure and extension-specific scope.
• 12 external JS hosts referenced in extension files across 3 countries; supply-chain surface for a simple URL shortener.

Evidence

• privacy_policy_generic_admits_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → D clause → +10.0 privacy.
• cve_jquery_1.9.1_three_medium crx jquery@1.9.1 has CVE-2019-11358, CVE-2020-11023, CVE-2015-9251 (all medium); >=3 medium CVEs → +2.0 CVE pillar.
• no_csp_plus_jquery_cves crx csp_present=false AND jquery CVEs present; v2e: jquery@<3.5+no CSP → +2.0 code quality.
• developer_free_webmail store bkdrx1@gmail.com; no business website; reputation floor applies (free webmail + no business site).
• featured_by_google store is_featured_by_google=true; -2.0 reputation discount applied.
• 12_external_js_hosts crx js_external_hosts has 12 entries across CA/IN/US; host_geo_diversity country_count=3 (below threshold of 4).
• maintenance_3_6_months store months_since_update=11; falls in 6-12mo band → +3.5 maintenance.
• no_bad_hosts_or_affiliate_hits api threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty; no Webstore threat-intel penalties.

CVE Exposures (3)

Permissions Breakdown

• activeTab low Only accesses current tab on user action; limited blast radius.
• contextMenus low Adds right-click menu items; no data exfil risk alone.
• unlimitedStorage low Local storage expansion; no network risk by itself.
• storage low Local key-value store; standard for extension state.
• alarms low Scheduled tasks; low risk without network exfil findings.
• scripting medium Can inject scripts into active tab; elevated when paired with CVEs in bundled jQuery.

Pillar Scores

Bookkeeping