Top Risks

• Bundled underscore@1.8.3 has critical RCE (CVE-2021-23358); content script runs on twitter.com
• Abandoned 35 months with known-vulnerable library; no patch path
• Privacy policy URL unfetchable; data handling undisclosed
• new Function() usage in background/content scripts increases injection surface

Evidence

• critical_cve_bundled crx underscore@1.8.3 in js/content.js: CVE-2021-23358 critical ACE, fixed 1.12.1
• high_cve_bundled crx underscore@1.8.3: CVE-2026-27601 high-severity DoS, fixed 1.13.8
• stale_maintenance store Last updated Dec 2023; 35 months without update
• privacy_unfetchable api Policy URL fetch_error:ConnectionError; no disclosure of collection or sharing
• function_constructor crx new Function() in 3 files (background, inpage, element)
• csp_strict manifest MV3 CSP script-src 'self'; no remote code loading; amplifier not applied
• narrow_scope manifest Only tabs+storage; content script scoped to twitter.com; no host_permissions
• verified_publisher store Verified publisher; reputation floored at 2.0; cap rule moot (no discount applied)

CVE Exposures (2)

Permissions Breakdown

• tabs medium Tab enumeration/access; moderate exposure scoped by narrow twitter.com content script
• storage low Local state persistence; standard low-risk permission

Pillar Scores

Bookkeeping