Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Traffic Escape Game [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack and install URL hijack flags active — potential traffic redirection on install/uninstall.
• Privacy policy hosted on CDN (cloudapi.stream), not scoped to this extension, data_collection=true with third_party_silence.
• Free-webmail developer (gmail) with no developer name listed raises accountability concerns.
• DOM-XSS sink via innerHTML with navigator.userAgent in popup script.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target null but flag is true — traffic redirection risk on uninstall.
• install_url_hijack crx onInstalled opens popup/index.html — internal target, low severity but flag present.
• free_webmail_developer store Developer email viktornadiezhdin@gmail.com; no developer name, no business domain.
• privacy_policy_not_scoped api Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=true, retention=false, third_party_silence=true.
• dom_xss_sink crx innerHTML set from navigator.userAgent string in popup/scripts/supportcheck.js — DOM-XSS vector.
• sandbox_csp_unsafe_eval manifest Sandbox CSP allows unsafe-inline and unsafe-eval on script-src; extension_pages CSP is strict.
• verified_publisher store Verified publisher badge present; partial trust credit applied.
• low_installs store Only 153 installs; limited blast radius but tail-attack-surface anomaly not triggered per computed data.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Traffic Escape Game [credential-theft] + malext.io malicious_extension_sentry; score 2.47 -> 4.97 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping