Top Risks

• MANAGEMENT PERMISSION: extension can enumerate and disable other installed extensions (incl. security and privacy tools).
• Critical CVE in bundled underscore@1.8.3 (CVE-2021-23358: Arbitrary Code Execution) — unpatched, fixed_in 1.12.1
• Dynamic script injection (script_src_dynamic) + new Function() constructor in Gmail/Docs injectors — remote code execution surface
• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing==true — ADMITS broad data sharing without extension scoping
• Broad host access (http://*/*, https://*/*) combined with webRequest and management permissions

Evidence

• critical_cve_bundled_lib crx underscore@1.8.3 has CVE-2021-23358 (critical, ACE); fixed in 1.12.1 — not updated.
• dynamic_script_injection crx script_src_dynamic found in 5 JS files including Gmail and Docs injectors.
• function_constructor crx new Function() constructor present in 5 JS files; elevated code execution risk.
• privacy_policy_scope_mismatch store Policy fetched but scope_extension=false; admits data_collection+third_party_sharing without extension-specific scope.
• broad_host_access_plus_webrequest manifest http://*/*, https://*/* host perms combined with webRequest and management permissions.
• verified_publisher_featured store Verified publisher + featured by Google; discount capped at -1.0 due to stale (17mo) + CVEs (invariant 0c/0e).
• maintenance_stale store Last updated Jan 2025, 17 months ago; vulnerable lib unpatched in that window.
• ai_extension_broad_content_scripts manifest AI writing tool with content scripts on Gmail, Docs, LinkedIn, WhatsApp, Outlook plus http/https wildcard.

CVE Exposures (2)

Permissions Breakdown

• scripting medium Can inject scripts into pages; paired with broad host access elevates risk.
• tabs medium Access to tab URLs, titles and navigation data.
• webNavigation medium Monitors all navigation events across all sites.
• management high Can list/disable/enable other installed extensions.
• alarms low Scheduled tasks; minimal standalone risk.
• clipboardWrite medium Can write to clipboard silently.
• storage low Local extension data storage.
• webRequest high Observes all network requests across broad host access.
• http://*/* high Broad host access across all HTTP sites.
• https://*/* high Broad host access across all HTTPS sites.

Pillar Scores

Bookkeeping