Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware] (+2.0, capped).
• Critical + high CVEs in bundled lodash/jquery at unknown versions with no CSP; DOM-manipulation libs without policy amplifier applied.
• Uninstall and install URL hijacks flagged — monetization/tracking behaviour on install and removal lifecycle.
• Privacy policy is Google's generic account policy — not scoped to this extension; collects and shares data with third parties.
• webRequest + *://*/* content scripts allow observation and manipulation of all browser traffic across every site.

Evidence

• cve_critical_lodash crx CVE-2019-10744 critical prototype pollution in lodash and lodash-es at unknown versions bundled in popup.js.
• cve_high_lodash_jquery crx Multiple high-severity CVEs: CVE-2021-23337 (command injection lodash), CVE-2018-16487, CVE-2018-3721; moderate jQuery XSS CVEs.
• cve_amplifier_no_csp crx No CSP present + high/medium CVEs in lodash (DOM-manipulation lib) → ×1.5 CVE amplifier applied (cap 10).
• uninstall_install_hijack crx Both uninstall_url_hijack and install_url_hijack are true — lifecycle event hooking for tracking/monetization.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing=true.
• webRequest_broad_host manifest webRequest declared alongside *://*/* host_permissions and content_scripts — intercepts all traffic on all sites.
• free_webmail_developer store Developer email pickercolor@outlook.com is free webmail; no verified publisher badge; no business domain.
• dom_sink_innerhtml crx scripts/options.js: innerHTML assigned from variable — DOM-XSS sink with no CSP guard.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware]; score 7.28 -> 9.28 (+2.0 cap 2.5).

CVE Exposures (15)

Permissions Breakdown

• activeTab low Scoped to user-initiated tab interaction only.
• notifications medium Can push notifications; minor abuse vector.
• storage low Local data persistence; low standalone risk.
• webRequest high Can observe all network requests across all URLs.
• contextMenus low Adds right-click menu items; low risk.
• commands low Keyboard shortcut binding; low risk.
• *://*/* high Broad host access — content scripts injected into every site.

Pillar Scores

Bookkeeping