Top Risks

• Bundled angular@1.8.2 carries 1 high + 4 moderate + 3 low CVEs; no fixed_in version available — unpatched.
• eval_user_input and function_constructor signals in angular.min.js and pouchdb lib increase XSS/RCE surface.
• innerHTML DOM sink in bootstrap.min.js; CSP lacks unsafe-eval but bundled eval-pattern still present.
• Privacy policy collected data but no retention period disclosed and third_party_sharing silence.
• Developer name blank; only email identity; no rated review data to calibrate user trust.

Evidence

• cve_high_angular crx CVE-2024-21490 high-severity angular@1.8.2 super-linear backtracking; no fixed_in.
• cve_moderate_angular_x4 crx CVE-2023-26117, CVE-2023-26116, CVE-2022-25844, CVE-2022-25869, CVE-2023-26118 — 5 moderate AngularJS ReDoS/XSS CVEs.
• code_eval_user_input crx eval_user_input in angular.min.js: direct eval() of variable inside $apply.
• code_function_constructor crx new Function() in angular.min.js and pouchdb.replication-stream.no-eval.min.js.
• code_dom_sink crx innerHTML assignment from variable in bootstrap.min.js — DOM-XSS sink.
• verified_publisher_featured store Verified publisher + featured badge; developer domain resolves; no bad hosts.
• privacy_no_retention api Privacy policy scoped but retention == false and third_party_silence == true.
• maintenance_3_6mo store Last updated Oct 2025; 8 months since update — 3-6 month band (+1.5).

CVE Exposures (10)

Permissions Breakdown

• tts low Text-to-speech; scoped to audio output only, no data exfil.
• contextMenus low Adds right-click menu items; no sensitive data access.
• storage low Local/sync storage for highlight data; standard for productivity.
• activeTab low Scoped to user-activated tab only; limited reach.

Pillar Scores

Bookkeeping