Top Risks

• cookies + broad host_permissions (https://*/*) allows reading session cookies on all visited sites.
• 5 innerHTML DOM-XSS sinks across core JS files with no CSP; exploitable if cart data is attacker-controlled.
• 4 sibling extensions under same developer fingerprint expand operator attack surface.
• Privacy policy admits data collection and third-party sharing but omits retention period.
• No developer name listed; reduces accountability for broad-host shopping extension.

Evidence

• broad_host_permissions manifest host_permissions include https://*/* and http://*/* giving access to all sites.
• cookies_high_perm manifest cookies permission paired with <all_urls> host access; can read/set session cookies everywhere.
• dom_xss_sinks crx 5 files contain innerHTML assignments from variables; no CSP to mitigate DOM-XSS.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening.
• operator_cluster store 4 sibling extension IDs share same developer email/CSP-host fingerprint.
• privacy_third_party_sharing store Policy fetched; scope_extension=true but third_party_sharing=true and retention=false.
• no_developer_name store developer_name field is empty; only email info@share-a-cart.com available.
• is_featured_by_google store Google Featured badge present; partial trust signal offsetting some reputation risk.

Permissions Breakdown

• alarms low Scheduled background tasks; minimal standalone risk.
• clipboardWrite medium Can push data to clipboard; shopping share use-case plausible.
• storage low Local key-value store; standard.
• unlimitedStorage low Removes storage quota; low standalone risk.
• tabs medium Can read tab URLs/titles across all open tabs.
• cookies high Can read/write cookies on all origins per host_permissions https://*/*.
• activeTab low Scoped to user-activated tab only; limited blast radius.
• scripting high Programmatic script injection into pages; paired with broad host access.
• https://*/* high Broad host permission covering all HTTPS origins.
• http://*/* high Broad host permission covering all HTTP origins.

Pillar Scores

Operator Siblings (4)

Other extensions sharing this developer's compound fingerprint:

• loaconldpakjgijhffiobikhlcdmbikc
• nlhfmidcpehddipkjeegjgdkdafekaem
• peiobddfomnijgoblelfdmjblplojcoe
• pmmodpeofmnekbdbjojhidofleeacmij

Scoring History

Bookkeeping