Top Risks

• Privacy policy admits data collection and third-party sharing without scoping to this extension (v3.5-D applies: +10.0 privacy).
• Uninstall URL hijack flagged; install_url_hijack also present — monetization-shell behavioral indicators.
• jquery@3.1.1 bundles 3 medium-severity CVEs (XSS); unfixed and below 3.5.0 threshold.
• External JS hosts include chrome-ext.blogspot.ru and jqueryte.com — non-dev third-party domains with unclear trust.
• Developer name 'ad' is single-character with no verified publisher badge; reputation signal weak.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both flags true; uninstall_url_target null but hijack set; install opens ./options.html — monetization shell indicators.
• privacy_policy_classification crx scope_extension=false, data_collection=true, third_party_sharing=true — v3.5-D triggers +10.0 privacy pillar.
• jquery@3.1.1 CVEs crx 3 medium-severity CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed_in 3.5.0; version 3.1.1 bundled.
• js_external_hosts crx chrome-ext.blogspot.ru and jqueryte.com are non-developer third-party JS hosts; trust unverifiable.
• is_featured_by_google store Extension carries Featured badge; partial reputation credit applied (-2.0 reputation).
• developer identity store Developer name 'ad'; no verified publisher; email ad@zework.com; no recognized org discount.
• host_geo_diversity api JS hosts span CA, US, VN (3 countries); below +1.5 threshold of 4.
• webstore install_count + uninstall hijack store 100,000 installs with uninstall hijack raises blast radius concern for any future compromise.

CVE Exposures (3)

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low risk for a notepad app.
• contextMenus low Adds right-click menu items; minimal risk.
• storage low Standard local storage access; expected for notepad functionality.
• host: https://notepad-online.ru/* medium Scoped to .ru domain; raises jurisdiction concern but narrow scope.
• host: http://notepad-online.ru/* medium HTTP (non-TLS) access to external .ru domain; weak transport security.
• host: https://zework.com/* low Developer's own domain; expected for settings/sync.

Pillar Scores

Bookkeeping