Top Risks

• Privacy policy fetched but not scoped to extension and lacks data collection details
• Content scripts run on all URLs with multiple medium CVEs in bundled jQuery
• No CSP defined despite broad host access and new Function() usage in code
• Install URL hijack opens third-party page on install
• Uninstall URL hijack detected

Evidence

• verified_publisher_cap_monetization api Verified publisher discount capped at -1.0 due to non-empty CVE findings and stale > 18mo code
• privacy_policy_not_scoped api Policy fetched but scope_extension=false and data_collection=false -> +9.0
• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() detected targeting 3rd party
• install_url_hijack manifest onInstalled opens https://www.meowplayground.com/welcome
• cve_medium_multiple api Multiple medium-severity jQuery CVEs (1.9.1, 3.3.1) with no CSP x1.5 amplifier
• function_constructor crx new Function() constructor found in popup.js, vue.min.js, browserLoader.js
• broad_host_access manifest <all_urls> host permission with content scripts on all URLs
• no_csp_mv3 manifest MV3 extension with null CSP and broad host permissions

CVE Exposures (6)

Permissions Breakdown

• <all_urls> high Broad host access allowing content scripts on any site.
• notifications medium Can display system notifications to the user.
• storage low Local storage for extension state, low risk.
• alarms low Scheduling periodic tasks, low risk.

Pillar Scores

Bookkeeping