Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing (Privacy pillar: 10.0).
• jquery@2.0.3 has 4 medium CVEs (XSS); library far below fixed_in versions; combined with innerHTML sinks raises exploitability.
• Dynamic <script> creation in bundled TinyMCE loads external JS at runtime — remote code loading risk.
• Uninstall URL hijack flag set (uninstall_url_hijack=true); destination unknown but warrants review.
• 12 js_external_hosts referenced in CSP/code (delicious.com, feedburner, flickr, friendfeed, twitter, youtube, etc.) — broad social/CDN surface for a notes app.

Evidence

• privacy_policy_generic store Privacy policy points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → Privacy pillar 10.0.
• cve_jquery_medium_x4 crx jquery@2.0.3 has CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all medium, unfixed at bundled version).
• script_src_dynamic crx TinyMCE bundles dynamic <script> src construction in jquery.tinymce.js and jquery.tinymce.min.js.
• dom_sink_innerHTML_widespread crx dom_sink_innerhtml_userctrl found in 14 files across TinyMCE, Readability, materialize, sweetalert, reveal.js.
• uninstall_url_hijack crx uninstall_url_hijack=true; target URL null/unknown — potential tracking or redirect on uninstall.
• external_hosts_broad crx 11 external JS hosts in CSP: delicious.com, digg.com, feedburner, flickr, friendfeed, googleapis, twitter, youtube, noteboardapp.com, etc.
• verified_featured_publisher store verified_publisher=true, is_featured_by_google=true; discount applied but capped due to monetization/affiliate context absent — full discount applies.
• csp_sandbox_remote_scripts manifest CSP sandbox allows script-src including gstatic, googleapis, ajax.googleapis, note-board-web.firebaseio.com, *.firebaseio.com.

CVE Exposures (4)

Permissions Breakdown

• contextMenus low Adds right-click menu items; minimal risk.
• unlimitedStorage low Allows storing more data locally; no data exfil risk on its own.
• activeTab low Access to current tab only on user gesture; limited scope.
• storage low Local key-value storage; expected for notes app.
• scripting medium Can inject scripts into pages; paired only with activeTab, so limited.
• alarms low Scheduled callbacks; used for reminders.
• offscreen low Off-screen document for background tasks; low direct risk.
• system.display low Read display info; used for sticky note positioning.

Pillar Scores

Bookkeeping