Top Risks

• Critical CVE-2021-23358 (Arbitrary Code Execution) in bundled underscore@1.8.3; no CSP amplifies exploit risk.
• Privacy policy admits data collection and third-party sharing without scoping to this extension (generic policy, 508KB).
• Brand impersonation: 'Telegram' mentioned in title/name by unverified free-webmail developer with no business identity.
• Developer uses gmail.com with no developer name; free-webmail + no org identity raises trust concerns.
• Description promises download but 'downloads' permission is absent — permission/function mismatch.

Evidence

• critical_cve_underscore crx underscore@1.8.3 in price.js: CVE-2021-23358 (Arbitrary Code Execution, fixed in 1.12.1). No CSP present.
• generic_privacy_policy store Policy fetched (508KB), scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[telegram]; developer not confirmed owner.
• free_webmail_dev_no_name store developer_email=ericlyle8669@gmail.com; developer_name empty; no business website verified.
• description_permission_mismatch manifest promises 'download' but 'downloads' permission not declared.
• external_host_igtools_ai crx js_external_hosts includes igtools.ai; operator fingerprint ties dev email to this domain.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; caps discount to -1.0 under v3.5 invariant 0c (monetization N/A but CVEs present).
• cve_amplifier_no_csp crx csp_present=false + critical/high CVEs in underscore (DOM-adjacent lib). CVE pillar ×1.5 amplifier applied.

CVE Exposures (2)

Permissions Breakdown

• storage low Stores local extension data; minimal risk.
• activeTab low Accesses current tab only on user action; limited scope.
• identity medium Can request OAuth tokens; risk of identity data access.
• https://web.telegram.org/* medium Content script on Telegram web; can read/modify all Telegram page content.

Pillar Scores

Scoring History

Bookkeeping