Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 (arbitrary code execution); not patched to fixed_in 1.12.1.
• High CVE-2026-27601 also in underscore@1.8.3; two unfixed CVEs in same lib compound risk.
• Privacy policy URL points to Google's own policy (unfetchable, not extension-scoped) — no real disclosure.
• new Function() constructor in popup.js, background.js, options.js — dynamic code execution surface.
• innerHTML sinks in contentScript.js (runs on YouTube/Udemy/Udacity) with no CSP; DOM-XSS risk amplified by CVEs.

Evidence

• critical_cve_bundled_lib crx underscore@1.8.3 carries CVE-2021-23358 (critical, arbitrary code exec); fixed_in 1.12.1 — version not updated.
• high_cve_bundled_lib crx underscore@1.8.3 also carries CVE-2026-27601 (high, DoS via recursion); fixed_in 1.13.8.
• privacy_policy_unfetchable_generic store Privacy policy URL is Google account policy; fetch failed (ConnectionError); not extension-scoped.
• function_constructor_multiple_files crx new Function() found in popup.js, background.js, options.js — dynamic code eval surface across 3 files.
• dom_xss_sink_no_csp crx innerHTML sinks in 597.js and contentScript.js; MV3 but no explicit CSP — amplifies XSS risk via CVE libs.
• free_webmail_dev_no_name store Developer email is Gmail (dev.fachory@gmail.com); no developer_name set — limited accountability.
• verified_and_featured store Extension is verified publisher and featured by Google — positive trust signals partially offsetting reputation risk.
• content_scripts_youtube_education manifest Content scripts scoped to YouTube, Udemy, Udacity only — narrow and matches stated translation function.

CVE Exposures (2)

Permissions Breakdown

• storage low Stores extension settings locally; no cross-origin data risk.
• content_scripts: https://*.udemy.com/course/*/learn/* medium Injects JS into Udemy course pages; scoped but grants DOM access including user activity.
• content_scripts: https://learn.udacity.com/* medium Injects JS into Udacity pages; scoped but grants DOM access.
• content_scripts: https://www.youtube.com/* medium Injects JS into all YouTube pages; broad within YouTube, high user traffic.

Pillar Scores

Bookkeeping