Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 (Arbitrary Code Execution); high CVE-2026-27601 also present.
• webRequest + <all_urls> allows full observation of all HTTP traffic across every site.
• Developer is free-webmail Gmail account with no verified business identity.
• Privacy policy hosted on Google Sites; data_collection=true but no retention disclosure.
• DOM-XSS sinks (innerHTML from variable) in contentScript.js and popup.js; CSP present but libs are vulnerable.

Evidence

• cve_critical_underscore crx underscore@1.8.3 has CVE-2021-23358 (critical, Arbitrary Code Execution); fixed in 1.12.1. Still bundled.
• cve_high_underscore crx underscore@1.8.3 has CVE-2026-27601 (high, DoS via recursion); fixed in 1.13.8.
• webrequest_all_urls manifest webRequest + <all_urls> host permission enables passive surveillance of all browser network traffic.
• free_webmail_developer store Developer email is vandathinhadu@gmail.com; no verified business domain; not a verified publisher.
• privacy_policy_google_sites store Policy hosted on Google Sites; scope_extension=true but retention=false and third_party_silence=true.
• dom_xss_sink crx innerHTML from variable in contentScript.js and popup.js; DOM-XSS risk if attacker controls page content.
• is_featured_by_google store Extension carries Google Featured badge, partially offsetting unverified developer reputation.
• js_external_hosts crx lodash.com, openjsf.org, reactjs.org, underscorejs.org listed as JS hosts; no bad-host hits detected.

CVE Exposures (2)

Permissions Breakdown

• storage low Local state only; no cross-site risk.
• activeTab low Scoped to user-initiated tab; acceptable for downloader.
• downloads medium Can save arbitrary files to disk; expected for video downloader.
• webRequest high Observes all network requests across all URLs; high surveillance capability.
• <all_urls> (host_permission) high Grants content script and webRequest access to every site the user visits.

Pillar Scores

Bookkeeping