Top Risks

• Privacy policy is Google's generic account policy — does not mention this extension, its data collection, or scope.
• jQuery 3.2.1 bundles 3 unpatched medium CVEs (XSS); no CSP to mitigate DOM exploitation.
• Developer is free-webmail only (gmail.com) with no business identity or verified publisher status.
• No content_security_policy defined (MV3 strict default applies but bundled vulnerable jQuery raises residual risk).
• Extension updated 6 months ago; jQuery dependency remains unfixed at 3.2.1 despite fixes available since 3.5.0.

Evidence

• google_generic_privacy_policy store Privacy URL points to myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true per classification.
• cve_jquery_3.2.1 crx jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); all fixed in 3.5.0.
• no_csp manifest csp_present=false; MV3 default applies but no explicit CSP hardening — amplifies jQuery XSS risk.
• free_webmail_developer store Developer email jiayephy@gmail.com; no business domain, no verified publisher badge.
• featured_by_google store is_featured_by_google=true; partially offsets unverified developer concern.
• no_bad_hosts_or_affiliate api threat_intel shows empty bad_host_hits, affiliate_hits, and monetization_hits.
• low_permissions manifest Only tabs, storage, contextMenus declared; no host_permissions or content_scripts.
• maintenance_6mo store Last updated January 4, 2025 (~6 months ago); jQuery vuln unaddressed across that window.

CVE Exposures (3)

Permissions Breakdown

• tabs medium Can read tab URLs/titles; core to tab manager function but enables browsing history inference.
• storage low Local data persistence; no exfil risk on its own.
• contextMenus low Adds right-click menu items; minimal risk.

Pillar Scores

Bookkeeping