Top Risks

• Uninstall URL hijack and install URL hijack detected — monetization/tracking redirect pattern.
• Privacy policy hosted on third-party CDN (cdn.cloudapi.stream), not scoped to this extension; no data collection scope stated.
• jquery@3.2.1 bundles 3 moderate CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023), unfixed.
• Sandbox CSP allows unsafe-inline and unsafe-eval, enabling script injection risk in sandboxed context.
• Gmail developer with no verified publisher; 11 external JS hosts referenced in extension bundle.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install_url_hijack also true, onInstalled opens popup/index.html.
• privacy_policy_not_scoped crx Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true.
• cve_moderate_jquery crx jquery@3.2.1 has 3 moderate CVEs; fixed_in 3.5.0; version still bundled unfixed.
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src within sandboxed page.
• free_webmail_dev store Developer email kiev3381917@gmail.com — free webmail, no verified publisher, no business website.
• external_js_hosts crx 11 external JS hosts referenced: bnjmnt4n.now.sh, cloudapi.stream, codecanyon.net, createjs.com, etc.
• low_install_count store Only 22 installs; tail-attack-surface risk low but extension has minimal trust signal.
• install_url_hijack_target crx install_url_target is popup/index.html (internal); uninstall target null — hijack flag raised but low impact.

CVE Exposures (3)

Pillar Scores

Bookkeeping