Top Risks

• Abandoned: 41 months since last update — zombie extension with growing attack surface.
• Brand impersonation: developer uses hotmail.fr, not affiliated with Stack Overflow/Overflow.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• CVE: known-bad host web.archive.org associated with URLHaus malware_download finding.
• Two innerHTML DOM-XSS sinks with no CSP; page-content injection risk on Stack Exchange network.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; developer is anthococagne@hotmail.fr, not Stack Overflow Inc.
• stale_extension store Last updated January 24 2023; months_since_update=41 — exceeds 36-month zombie threshold.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• known_bad_host crx web.archive.org in js_external_hosts; URLHaus hit: 154.216.19.139 malware_download (elf).
• dom_xss_no_csp crx 2x dom_sink_innerhtml_userctrl findings; csp_present=false amplifies risk per FIX B.
• install_url_hijack crx install_url_hijack=true; target null — opens 3rd-party or unknown URL on install.
• geo_diversity crx JS hosts span 4 countries (CA, IN, SG, US); threshold met but category is DeveloperTools (+1.5).
• free_webmail_dev store Developer email on hotmail.fr; no business website; not a verified publisher.

CVE Exposures (1)

Permissions Breakdown

• storage low Stores user preferences locally; no cross-site data risk.
• content_scripts on *.stackoverflow.com etc. medium Content scripts run on Stack Exchange network pages; DOM access is bounded to those sites.

Pillar Scores

Bookkeeping