Netskope Extension Risk

Detail view · rubric v3.6
← Back to catalog

Simple Volume Booster

fbjhgeaafhlbjiejehpjdnghinlcceak
Risk Score
5.57
Risk Level: Medium
Recommendation: 🟡 MEDIUM RISK — review
Category Other
Installs 50,000
Rating 4.7
Last updated 2025-09-22 (11 months ago)
Manifest version MV3
CSP present ❌ no
Developer den9889rice@gmail.com
Verified publisher ❌ no
Featured by Google ✅ yes
Privacy policy link
Web Store open ↗

Top Risks

  • Critical+high CVEs in bundled lodash, axios, moment at unknown (potentially unfixed) versions — exfil/injection risk.
  • Axios bundled in a volume booster is anomalous — HTTP client not needed for audio processing; suggests telemetry/data collection.
  • Broad host_permissions (*://*/*) combined with tabCapture allows audio capture from any site.
  • Developer uses free Gmail; no verified publisher badge; dev domain not evaluated.
  • No CSP on MV3 extension loading external JS from getbootstrap.com and github.com.

Evidence

  • critical_cve_lodash crx CVE-2019-10744 (critical) prototype pollution in bundled lodash@unknown; 3 high CVEs also present in lodash.
  • high_cve_axios_exfil crx CVE-2026-42033 axios prototype pollution enabling data exfil/request hijacking; 10+ additional high/moderate axios CVEs.
  • anomalous_libraries crx axios, lodash, moment bundled in a volume booster — none required for Web Audio API; suggests hidden functionality.
  • external_js_hosts manifest js_external_hosts includes getbootstrap.com and github.com; CSP absent (MV3 no default enforcement here).
  • broad_host_permissions manifest host_permissions *://*/* combined with tabCapture grants audio capture from any site.
  • privacy_policy_gaps store Policy admits data collection and third-party sharing but no retention period disclosed.
  • gmail_developer store Developer email den9889rice@gmail.com; no verified publisher; free webmail raises accountability concern.
  • featured_badge store Extension is featured by Google, providing partial trust signal; partially offsets reputation risk.

CVE Exposures (35)

CVELibrarySeverity Fixed inSummary
CVE-2017-18214 moment@unknown high 2.19.3 Regular Expression Denial of Service in moment
CVE-2016-4055 moment@unknown moderate 2.11.2 Regular Expression Denial of Service in moment
CVE-2022-24785 moment@unknown high 2.29.2 Path Traversal: 'dir/../../filename' in moment.locale
CVE-2021-23337 lodash@unknown high 4.17.21 Command Injection in lodash
CVE-2026-4800 lodash@unknown high 4.17.21 Command Injection in lodash
CVE-2018-16487 lodash@unknown high 4.17.11 Prototype Pollution in lodash
CVE-2025-13465 lodash@unknown moderate 4.18.0 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and
CVE-2026-2950 lodash@unknown moderate 4.18.0 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and
CVE-2018-3721 lodash@unknown moderate 4.17.5 Prototype Pollution in lodash
CVE-2019-10744 lodash@unknown critical 4.17.12 Prototype Pollution in lodash
CVE-2026-41907 uuid@unknown moderate 11.1.1 uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
CVE-2026-41988 uuid@unknown moderate 11.1.1 uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
CVE-2025-62718 axios@unknown moderate 1.15.0 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
CVE-2019-10742 axios@unknown high 0.18.1 Denial of Service in axios
CVE-2026-25639 axios@unknown high 1.13.5 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
CVE-2020-28168 axios@unknown moderate 0.21.1 Axios vulnerable to Server-Side Request Forgery
CVE-2026-42034 axios@unknown moderate 1.15.1 Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
CVE-2026-42039 axios@unknown moderate 1.15.1 Axios: unbounded recursion in toFormData causes DoS via deeply nested request da
CVE-2026-42035 axios@unknown high 1.15.1 Axios: Header Injection via Prototype Pollution
CVE-2026-44490 axios@unknown moderate 1.16.0 axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in ax
CVE-2021-3749 axios@unknown high 0.21.2 axios Inefficient Regular Expression Complexity vulnerability
CVE-2026-40175 axios@unknown moderate 1.15.0 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
CVE-2026-44496 axios@unknown high 1.16.0 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
CVE-2026-44486 axios@unknown high 1.16.0 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-eval
CVE-2025-27152 axios@unknown high 1.8.2 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute U
CVE-2026-42038 axios@unknown moderate 1.15.1 Axios: no_proxy bypass via IP alias allows SSRF
CVE-2026-67316 axios@unknown moderate 1.18.0 Axios: Prototype pollution gadgets can alter axios request construction
CVE-2026-44487 axios@unknown high 1.16.0 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS
CVE-2026-42033 axios@unknown high 1.15.1 Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and
CVE-2026-44492 axios@unknown high 1.16.0 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowin
CVE-2026-42043 axios@unknown high 1.15.1 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC
CVE-2026-42036 axios@unknown moderate 1.15.1 Axios: HTTP adapter streamed responses bypass maxContentLength
CVE-2026-42041 axios@unknown moderate 1.15.1 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus`
CVE-2026-42040 axios@unknown low 1.15.1 Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
CVE-2026-42042 axios@unknown moderate 1.15.1 Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXS

Permissions Breakdown

  • activeTab medium Grants access to current tab on user action; limited scope.
  • tabCapture high Can capture tab audio/video streams; elevated capability for stated use case.
  • storage low Local extension storage only; minimal risk.
  • offscreen medium Hidden offscreen document can execute JS outside visible UI context.
  • *://*/* high Broad access to all origins amplifies tabCapture and content_script surface area.

Pillar Scores

Permissions4.30
Reputation5.50
Network3.50
Webstore1.00
Maintenance3.50
Privacy2.00
Code Quality0.00
CVE Exposure10.00

Bookkeeping

Rubric v3.6
Scored at 2026-08-28 07:51
Listing SHA 47588cf4aa1a…
Force block — not fired
Score recovered no
Elapsed —