Top Risks

• Privacy policy is Google's generic policy (not scoped to this extension) with data_collection+third_party_sharing=true admitted — highest privacy risk tier.
• Broad host_permissions (https://*/*, http://*/*) paired with cookies+scripting enables data exfiltration across all sites.
• Search engine and homepage overrides redirect all user queries to Bing with tracking params; 23 months stale (near 24-month threshold).
• Dynamic script injection (script_src_dynamic, function_constructor) detected in bundled JS; jquery@3.4.1 has two moderate XSS CVEs (unfixed).
• install_url_hijack and uninstall_url_hijack both flagged; extension opens install page on activation.

Evidence

• privacy_policy_generic_admits_collection store Policy URL is Google's myaccount privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• broad_host_permissions_with_cookies_scripting manifest https://*/*+http://*/*anted alongside cookies+scripting; ×1.2 amplifier applied; justified-broad discount not applicable (search override).
• search_provider_homepage_override manifest chrome_settings_overrides sets default search to bing.com with EID/pc tracking params and overrides startup_pages.
• cve_jquery_3_4_1_moderate crx jquery@3.4.1 bundles CVE-2020-11022 and CVE-2020-11023 (moderate XSS); fixed_in 3.5.0 not met.
• code_dynamic_script_injection crx script_src_dynamic in background.bundle.js and content.bundle.js; function_constructor also present.
• install_uninstall_url_hijack crx install_url_hijack=true (opens ../Welcomepage/index.html?xid=111&bmkt=); uninstall_url_hijack=true.
• maintenance_23_months_stale store Last updated July 25 2024; 23 months since update — approaching 24-month +6.0 band, currently +5.5 interpolated at 6.0.
• recognized_org_microsoft_cap_applied store Microsoft confirmed owner; -2.0 recognized-org discount capped at -1.0 per 0c (monetization: search override contacts bing.com/google.com, months>18).

CVE Exposures (2)

Permissions Breakdown

• cookies high Read/write cookies across paired broad host_permissions (https://*/*, http://*/*).
• declarativeNetRequest medium Can modify network requests; medium without blocking variant.
• tabs medium Access tab URLs and metadata for all open tabs.
• alarms low Periodic background task scheduling; low standalone risk.
• storage low Local extension data storage; low risk.
• contextMenus low Adds right-click menu items; low risk.
• notifications low Displays notifications; low risk standalone.
• scripting high Programmatic script injection into pages under broad host_permissions.
• host_permissions:https://*/* high Broad access to all HTTPS sites; amplifies cookies+scripting risk.
• host_permissions:http://*/* high Broad access to all HTTP sites; amplifies cookies+scripting risk.
• chrome_settings_overrides:search_provider medium Overrides default search engine to Bing; significant UX/data redirection.
• chrome_settings_overrides:homepage medium Overrides browser homepage to bing.com.

Pillar Scores

Scoring History

Bookkeeping