Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware] (+2.0, capped).
• Critical CVE in bundled underscore@1.8.3 (CVE-2021-23358, arbitrary code execution); also a high-severity CVE.
• Content scripts run on <all_urls> — every site visited is exposed to vulnerable underscore code.
• Developer uses free webmail (gmail) with no developer name; identity unverifiable despite verified-publisher badge.
• Description promises ad-blocking but lacks webRequest/declarativeNetRequest — permission-promise mismatch.

Evidence

• cve_critical crx underscore@1.8.3 has CVE-2021-23358 (critical, arbitrary code exec); fixed in 1.12.1.
• cve_high crx underscore@1.8.3 has CVE-2026-27601 (high, DoS via unlimited recursion); fixed in 1.13.8.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls>; scripts run on every page including those with sensitive data.
• dev_identity store Developer email is free webmail (gmail); no developer name listed; identity unverifiable.
• description_mismatch store Description promises ad-blocking but no declarativeNetRequest or webRequest declared.
• dom_sink_innerhtml crx innerHTML from variable in RateUsModalProvider.js and content.js — DOM-XSS sink; CVEs present.
• privacy_third_party_silence api Privacy policy scoped and discloses collection/retention but silent on third-party sharing.
• verified_featured store Extension is verified publisher + featured by Google; partially offsets reputation concerns.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware]; score 2.93 -> 4.93 (+2.0 cap 2.5).

CVE Exposures (2)

Permissions Breakdown

• storage low Stores blocked-site lists locally; standard for this category.
• tabs medium Reads tab URLs to enforce blocking rules; expected but grants URL visibility.
• alarms low Used for scheduled blocking windows; low risk.
• webNavigation medium Monitors navigation events; needed for blocking but observes all URLs.
• content_scripts:<all_urls> high Content scripts injected on every site; broad reach even without host_permissions.

Pillar Scores

Bookkeeping