Top Risks

• Privacy policy fetch failed (timeout); treated as no policy — score 10.0 on privacy pillar.
• nativeMessaging declared but companion-app publisher not recognized, enabling local system bridge.
• jquery@3.1.1 bundles 3 moderate CVEs (XSS); fixed versions available (3.4.0/3.5.0) — library not updated.
• cookies + <all_urls> + webRequest + scripting combination grants broad read/write capability across every site.
• 6 innerHTML DOM-XSS sinks in content scripts active on <all_urls>; CVEs present amplify XSS surface.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL present but fetch timed out; classified as fetched=false → pillar scores 10.0.
• native_messaging_unrecognized_publisher crx nativeMessaging declared; native_messaging_check.publisher_recognized=false.
• jquery_cve_bundle crx jquery@3.1.1 bundles CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all moderate); fixed_in 3.5.0.
• broad_host_access_high_perms manifest cookies+webRequest+scripting+<all_urls>; ×1.2 amplifier applied to permissions pillar.
• dom_xss_sinks crx 6 innerHTML-from-variable findings in content scripts running on <all_urls>; CVEs present → FIX B applies (+2.0).
• featured_by_google store is_featured_by_google=true; -2.0 reputation discount applied; floor 2.0 enforced.
• large_install_base store 328M installs; +1.0+1.0+0.5 webstore; -0.5 popularity-trust discount applied.
• recently_updated store months_since_update=0; maintenance pillar=0.0.

CVE Exposures (1)

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• tabs medium Can read tab URLs and titles across all open tabs.
• downloads medium Can intercept and manage file downloads.
• nativeMessaging high Communicates with native Adobe desktop app; publisher_recognized=false raises concern.
• webRequest high Can observe all HTTP requests across all URLs (paired with <all_urls>).
• webNavigation medium Tracks navigation events across tabs.
• storage low Local/sync data storage; minimal standalone risk.
• scripting high Can inject scripts into any page given <all_urls> host permission.
• alarms low Schedules background tasks; low risk.
• offscreen low Creates offscreen documents for background processing.
• cookies high Can read/write cookies for all sites paired with <all_urls>; ×1.2 amplifier applies.
• sidePanel low Renders UI in browser side panel.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• fileSystem medium Access to local file system entries.
• <all_urls> high Broad host access covering every site; amplifies cookies, webRequest, scripting.

Pillar Scores

Bookkeeping