Top Risks

• jquery@3.2.1 bundles 3 unpatched medium CVEs (XSS); library below fixed_in 3.5.0 with no CSP amplifies risk.
• scripting + <all_urls> host permission enables arbitrary JS injection on every visited page.
• Gmail-only developer identity (no dev name, free webmail) reduces accountability.
• Privacy policy discloses third-party sharing but omits retention; screenshot tool with broad host access is high-impact.
• 17 months since last update; CVEs and stale code compound under v3.5 invariant 0c cap.

Evidence

• host_permissions_all_urls + scripting manifest Extension declares <all_urls> host_permissions and scripting; content scripts also match <all_urls>.
• cve_jquery_3_medium_x3 crx jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); all fixed above 3.5.0.
• no_csp crx content_security_policy is null; MV3 default applies but CVE amplifier triggers (jquery DOM-manip lib + medium CVEs).
• function_constructor_usage crx new Function() found in js/editor.js and js/lib/fabric.js; dynamic code execution risk.
• developer_identity store developer_name empty; developer_email is free webmail (gisstapa@gmail.com); no business domain verifiable.
• verified_publisher + featured store verified_publisher=true and is_featured_by_google=true; discounts applied but capped per 0c (months_since_update=17).
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• description_promise_mismatch store Description promises recording but extension lacks tabCapture/desktopCapture permissions.

CVE Exposures (3)

Permissions Breakdown

• storage low Local key-value store; low impact on its own.
• unlimitedStorage low Extends storage quota; no cross-origin access.
• scripting high Programmatic script injection into pages; paired with <all_urls> host permission.
• <all_urls> (host_permissions) high Grants content script + scripting access to every URL the user visits.
• <all_urls> (content_scripts) high Content script injected on every page; broad data-read surface.

Pillar Scores

Scoring History

Bookkeeping