Top Risks

• Privacy policy hosted on CDN subdomain (cdn.cloudapi.stream), not scoped to this extension; admits third-party sharing.
• Three medium-severity jQuery XSS CVEs (3.2.1); unfixed — patched version is 3.5.0.
• Developer uses free Gmail address with no verified business identity.
• Sandbox CSP allows unsafe-inline and unsafe-eval, weakening XSS mitigations inside sandboxed pages.
• Obfuscated manifest name/description (__MSG_name__/__MSG_desc__) — localization strings not inspectable.

Evidence

• free_webmail_dev store Developer email is nadejdinv@gmail.com — no verified business domain; Reputation base raised.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false — no trust discounts applicable.
• privacy_policy_cdn_hosted_not_scoped crx Policy at cdn.cloudapi.stream; scope_extension=false, data_collection=false, third_party_sharing=true → +10 Privacy.
• jquery_cve_triple_medium crx jquery@3.2.1 carries CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all medium, fixed in 3.4/3.5).
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src, reducing XSS resistance in sandboxed context.
• no_permissions manifest Zero declared permissions and zero host_permissions; minimal attack surface.
• low_installs store Only 44 installs — blast radius minimal, but also no population signal for reputation.
• maintenance_3_to_6_months store months_since_update=4; falls in 3-6 month band → +1.5 Maintenance.

CVE Exposures (3)

Pillar Scores

Bookkeeping