Top Risks

• Free-webmail developer (gmail.com) with no verified business website
• Broad <all_urls> host access, though justified for translation category
• new Function() constructor present in background script
• Outdated jQuery UI 1.13.1 with medium-severity CVE-2022-31160
• Not updated in 12 months, indicating slowing maintenance

Evidence

• broad_host_access manifest host_permissions <all_urls> with content scripts on all pages
• free_webmail_dev store Developer email loiesmesserd@gmail.com; no verified business site
• featured_badge store Featured by Google (Follows recommended practices)
• function_constructor crx new Function() in js/bg.js; appears to be a CSP/capability probe
• cve_medium crx jquery-ui@1.13.1 CVE-2022-31160 (medium XSS), fixed in 1.13.2
• stale_update store Last updated Oct 2025; 12 months since update
• no_threat_intel_hits api No bad hosts, monetization, or affiliate hits; cluster size 0
• scoped_privacy_policy store Policy fetched, scoped to extension, no retention disclosure

CVE Exposures (1)

Permissions Breakdown

• contextMenus low Context menu integration, low impact
• storage low Local storage, low impact
• tabs medium Can access tab URLs and metadata
• <all_urls> (host) high Broad host access; justified for translation, discount applied

Pillar Scores

Bookkeeping