Top Risks

• Privacy policy hosted on CDN, not scoped to this extension, declares third-party sharing — generic/inadequate disclosure.
• Three moderate-severity jQuery CVEs (XSS) at version 3.2.1; all fixed in 3.4.0–3.5.0, library not updated.
• Uninstall and install URL hijack both present; install target is internal popup but hijack signals are concerning.
• Developer uses free Gmail address with no verified publisher status and no confirmed business domain.
• Sandbox CSP allows unsafe-inline and unsafe-eval on script-src, increasing XSS risk alongside unpatched jQuery.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both install and uninstall URL hijacks flagged; uninstall target null but flag set — pattern associated with traffic monetization shells.
• jquery@3.2.1 — 3 moderate CVEs unfixed crx CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 all XSS-class; fixed versions 3.4.0/3.5.0 not adopted.
• privacy_policy generic CDN, third_party_sharing=true, scope_extension=false api Policy at cdn.cloudapi.stream admits third-party sharing but is not scoped to this extension — maps to +10.0 privacy pillar per v3.5 rule D.
• sandbox CSP unsafe-eval + unsafe-inline manifest sandbox directive includes unsafe-inline and unsafe-eval on script-src, elevating XSS exploitation risk alongside CVE-vulnerable jQuery.
• free-webmail developer, no verified publisher store nadejdinv@gmail.com; not verified, not featured; developer_domain gmail.com confirms no business identity.
• 12 external JS hosts referenced in source crx js_external_hosts includes bnjmnt4n.now.sh, cloudapi.stream, createjs.com, goo.gl, and 8 others — broad external reference surface.
• install_url_hijack opens popup/index.html manifest onInstalled opens popup/index.html (internal), but hijack flag still signals gamification-shell install pattern.
• no permissions declared; no host_permissions; no content_scripts manifest Zero permissions reduce capability risk; extension is a self-contained game popup with no browsing access.

CVE Exposures (3)

Pillar Scores

Bookkeeping