Top Risks

• Gmail developer with no verified business identity
• Bundled jQuery 1.9.1 has 3 known medium XSS CVEs
• jQuery <3.5 combined with no CSP header
• Last update 9 months ago; maintenance gap
• Privacy policy admits data collection and third-party sharing

Evidence

• permissions manifest Only activeTab declared; no host_permissions or content_scripts
• reputation store Free webmail (gmail) with no business website; not verified
• cve crx jquery@1.9.1 flagged for 3 medium-severity XSS CVEs
• network manifest MV3 but no CSP defined; 5 external JS hosts including CDN
• maintenance store Last updated December 2025; 9 months since update
• privacy api Policy fetched, scoped to extension, but admits data_collection and third_party_sharing
• code_quality crx No obfuscation detected; no malicious code findings; 5 JS files scanned
• webstore store 1,000 installs; rating 4.8; no review red flags; no operator cluster

CVE Exposures (3)

Permissions Breakdown

• activeTab low Low-risk permission granted on user interaction; matches simple price-display function.

Pillar Scores

Bookkeeping