Top Risks

• Privacy policy hosted on cloudapi.stream CDN, not scoped to this extension, admits third-party sharing without extension context
• Uninstall and install URL hijack flags set — tracks install/uninstall lifecycle events
• jquery@3.2.1 bundles 3 moderate CVEs (XSS); fixed in 3.5.0, currently unfixed
• Free-webmail developer (gmail), no developer name, no verified publisher — low accountability
• 11 external JS hosts referenced; sandbox CSP allows unsafe-inline and unsafe-eval

Evidence

• uninstall_url_hijack + install_url_hijack crx Extension sets uninstall/install lifecycle hooks; install target is popup/index.html (internal), uninstall target null but flag true.
• privacy_policy_not_scoped crx Policy fetched from cdn.cloudapi.stream; scope_extension=false, data_collection=false, third_party_sharing=true — generic CDN-hosted policy.
• jquery CVEs x3 moderate crx jquery@3.2.1 has CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; all fixed in 3.5.0, library not updated.
• free_webmail_dev_no_name store Developer email nadejdinv@gmail.com, developer_name empty, not verified publisher, not featured.
• sandbox CSP unsafe-eval/unsafe-inline crx Sandbox CSP allows unsafe-inline and unsafe-eval on script-src, weakening sandbox isolation.
• 11 external JS hosts crx References: bnjmnt4n.now.sh, cloudapi.stream, codecanyon.net, createjs.com, getbootstrap.com, github.com, goo.gl, mths.be, popper.js.org, harrytheo.com, opensource.org.
• low install count + no permissions store 196 installs, zero declared permissions/host_permissions — minimal blast radius but accountability concerns remain.
• wayback_ownership fetch_error api Wayback check returned ReadTimeout; ownership history unverifiable.

CVE Exposures (3)

Pillar Scores

Bookkeeping