Top Risks

• Uninstall URL hijack and install URL hijack both set — common monetization/tracking pattern.
• Privacy policy hosted on CDN domain (cloudapi.stream), not scoped to this extension; third_party_sharing=true without disclosure.
• jquery@3.2.1 carries 3 medium-severity XSS CVEs (unfixed); sandbox CSP allows unsafe-eval/unsafe-inline.
• Developer uses free Gmail; no verified publisher badge; no business domain.
• 12 external JS host references in source, including goo.gl shortener and multiple third-party CDNs.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target null but hijack flag true — webstore rule +3.0.
• install_url_hijack crx onInstalled opens popup/index.html internally — +2.0 webstore signal applied.
• privacy_policy_scope store Policy fetched from CDN; scope_extension=false, data_collection=false, third_party_sharing=true → +9.0 privacy.
• cve_jquery crx jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed_in 3.5.0.
• sandbox_csp_unsafe crx Sandbox CSP allows unsafe-eval and unsafe-inline on script-src — amplifies CVE risk.
• free_webmail_developer store Developer email kiev3381917@gmail.com; no verified publisher; reputation start 5.0 +1.5 free-webmail.
• external_js_hosts crx 12 external hosts in JS including goo.gl shortener, cloudapi.stream, createjs.com, codethislab.com.
• v3.5B_empty_manifest_high_install crx MV3, 0 permissions, 0 host_permissions, 0 content_scripts; obfuscation=0, no code findings, 511 installs — below 100K threshold, no anomaly penalty.

CVE Exposures (3)

Pillar Scores

Bookkeeping