Top Risks

• Critical CVE-2021-23358 (arbitrary code execution) in bundled underscore@1.8.3 with no CSP — amplified XSS risk on LinkedIn pages.
• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection + 3rd-party sharing) — rates +10 under v3.5 rule D.
• No CSP + dom_sink_innerhtml in contentScript running on linkedin.com creates live DOM-XSS attack surface.
• brand_mention.is_impersonation=true for 'LinkedIn' without verified publisher status; LinkedIn is not confirmed owner.
• function_constructor (new Function) in background.js and popup.js — dynamic code execution pathway without sandbox.

Evidence

• cve_critical_underscore crx underscore@1.8.3 carries CVE-2021-23358 (critical, ACE); fixed_in 1.12.1. No CSP amplifies risk.
• privacy_policy_generic_google store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp_dom_xss crx csp_present=false + 3 innerHTML-from-variable sinks in files running on linkedin.com.
• brand_impersonation_linkedin store brand_mention.is_impersonation=true for LinkedIn; not verified_publisher, not confirmed_owner.
• function_constructor_background crx new Function() in background.js and popup.js — dynamic code execution without CSP guard.
• ai_extension_linkedin_content_script manifest AI extension with content_scripts on https://www.linkedin.com/* can read and modify all LinkedIn page content.
• is_featured_by_google store Extension carries Featured badge — partial trust signal, but does not offset CVE and privacy deficiencies.
• cve_high_underscore_dos crx CVE-2026-27601 (high) in underscore@1.8.3 — unlimited recursion DoS; fixed_in 1.13.8.

CVE Exposures (2)

Permissions Breakdown

• storage low Stores extension preferences/state locally; limited blast radius.
• *://*.ideta.io/* medium Allows content-script and fetch access to developer's own domain.
• *://*.linkedin.com/* medium Content-script runs on LinkedIn pages; can read/modify LinkedIn DOM and data.

Pillar Scores

Bookkeeping