Top Risks

• Free-webmail developer (nadejdinv@gmail.com), no developer name, no verified publisher — minimal accountability.
• Privacy policy on CDN domain (cloudapi.stream), not scoped to this extension; third_party_sharing=true with no extension-specific disclosure.
• Three medium-severity jQuery CVEs (3.2.1 < 3.5.0): XSS vulnerabilities bundled but not patched.
• Install URL hijack (onInstalled opens popup/index.html) and uninstall URL hijack flag set.
• 10 external JS hosts referenced in source; sandbox CSP allows unsafe-eval and unsafe-inline.

Evidence

• free_webmail_developer store Developer email nadejdinv@gmail.com; no developer name supplied; not verified publisher.
• install_url_hijack crx install_url_hijack=true targets popup/index.html; uninstall_url_hijack=true with null target.
• privacy_policy_not_scoped api Policy fetched from cdn.cloudapi.stream; scope_extension=false, data_collection=false, third_party_sharing=true.
• jquery_cve_medium_x3 crx jquery@3.2.1 has CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all medium, fixed in 3.5.0).
• sandbox_csp_unsafe crx Sandbox CSP allows unsafe-inline and unsafe-eval on script-src, elevating XSS risk with vulnerable jQuery.
• js_external_hosts_10 crx 10 external hosts referenced: cloudapi.stream, createjs.com, getbootstrap.com, goo.gl, github.com, others.
• low_install_count store Only 87 installs; tiny user base limits blast radius but also means minimal community vetting.
• no_operator_siblings api operator_cluster sibling_count=0; no known cluster of sibling extensions under same fingerprint.

CVE Exposures (3)

Pillar Scores

Bookkeeping