Top Risks

• Critical CVE in bundled underscore@1.8.3 (arbitrary code execution) + high CVE + 2 moderate jQuery CVEs — no CSP amplifies XSS risk.
• Broad host_permissions + cookies + webRequest on all sites: full traffic interception and cookie exfil possible.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension.
• Uninstall URL hijack detected; extension redirects on uninstall to a third-party URL.
• No CSP defined (MV3 default): DOM-manipulation libs with known XSS CVEs operate without policy guard.

Evidence

• cve_critical_underscore crx underscore@1.8.3 has CVE-2021-23358 (critical, arbitrary code execution); fixed in 1.12.1.
• cve_high_underscore crx underscore@1.8.3 has CVE-2026-27601 (high, DoS via unlimited recursion); fixed in 1.13.8.
• cve_moderate_jquery crx jquery@3.4.1 has CVE-2020-11022 and CVE-2020-11023 (moderate XSS); fixed in 3.5.0.
• no_csp manifest content_security_policy is null; no CSP guard while bundling DOM-manipulation libs with active XSS CVEs.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set to third-party target on uninstall.
• privacy_policy_unscoped store Policy fetched but scope_extension=false; admits data_collection=true and third_party_sharing=true — v3.5(D) applies.
• broad_host_cookies_webrequest manifest cookies + webRequest + http://*/* + https://*/* = full cross-site traffic and cookie interception.
• function_constructor crx new Function() found in all 3 JS bundles (content, background, popup); dynamic code construction risk.

CVE Exposures (4)

Permissions Breakdown

• cookies high Can read/write all cookies across all sites via broad host_permissions — affiliate tracking risk.
• storage low Local extension storage only; low standalone risk.
• tabs medium Can read tab URLs and titles; combined with broad host access raises surveillance risk.
• webRequest high Intercepts all HTTP/S requests across all sites; high capability for traffic inspection.
• http://*/* high Broad host permission covering all HTTP sites; enables content script injection everywhere.
• https://*/* high Broad host permission covering all HTTPS sites; enables content script injection everywhere.

Pillar Scores

Bookkeeping