Top Risks

• Privacy policy hosted on CDN domain (cloudapi.stream), not scoped to this extension; third_party_sharing=true admitted without scope.
• Three medium CVEs in bundled jquery@3.2.1 (unfixed; fixed_in 3.5.0); v2 jquery+no-CSP amplifier applies to sandbox CSP.
• Uninstall URL hijack flagged — extension registers an uninstall hook to a third-party destination.
• Install URL hijack flagged — onInstalled opens popup/index.html; pattern consistent with monetization shells.
• Developer uses free-webmail (gmail.com) with no verified publisher status and privacy policy on CDN domain.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() registered; target null in manifest but flagged by scanner — monetization shell signal.
• install_url_hijack crx onInstalled opens popup/index.html; combined with uninstall hook, matches low-effort traffic-monetization pattern.
• jquery_cve crx jquery@3.2.1 bundled; 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed_in 3.5.0.
• privacy_policy_cdn_hosted store Policy at cdn.cloudapi.stream — not dev-owned domain; scope_extension=false, third_party_sharing=true.
• sandbox_csp_unsafe crx Sandbox CSP includes 'unsafe-inline' and 'unsafe-eval' on script-src; jquery CVEs amplified by no safe CSP in sandbox.
• free_webmail_dev store Developer email nadejdinv@gmail.com; no verified publisher; no business domain.
• external_js_hosts crx Extension references cloudapi.stream, createjs.com, www.opensource.org — 3 distinct external domains.
• very_low_installs store Only 26 installs; high rating with no rating_count — statistical unreliability, possible fake signal.

CVE Exposures (3)

Pillar Scores

Bookkeeping