Top Risks

• Critical CVE-2021-23358 (arbitrary code execution) in bundled underscore@1.8.3 — not patched to fixed_in 1.12.1.
• High CVE-2026-27601 (DoS via recursion) in same underscore@1.8.3 bundle; two CVEs together reach cve_pillar 7.0.
• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing==true — policy admits wide sharing without scoping to this extension.
• eval_user_input found in 5113.js; direct eval of variable in a crypto-wallet context is a high-impact code quality concern.
• Broad https://*/*ost access paired with scripting permission enables injection across all HTTPS sites visited.

Evidence

• cve_critical_underscore crx underscore@1.8.3 carries CVE-2021-23358 (critical, ACE); fixed_in 1.12.1 — bundled version not patched.
• cve_high_underscore crx underscore@1.8.3 also carries CVE-2026-27601 (high, DoS); fixed_in 1.13.8.
• eval_user_input crx 5113.js: eval(code) called directly on variable; risk amplified in wallet context handling crypto keys.
• privacy_policy_generic_with_sharing store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → privacy pillar 10.0 per v3.5(D).
• broad_host_permissions manifest host_permissions includes https://*/*; scripting permission allows injection on all HTTPS origins.
• verified_publisher_coinbase store verified_publisher=true, developer_email @coinbase.com, brand confirmed owner — mitigates reputation pillar to floor 2.0.
• low_rating store Rating 2.7; no review red flags matched in review_red_flags scan.
• react_below_16.4 crx React 16.13.1 bundled; below threshold but CSP present — v2 CVE amplifier ×1.5 does not apply (underscore, not react).

CVE Exposures (2)

Permissions Breakdown

• activeTab low Only accesses the current tab on user action; scoped and intentional for a wallet.
• alarms low Background scheduling only; no data access.
• scripting medium Can inject scripts; paired with broad host_permissions increases surface.
• storage low Local key-value store; expected for wallet state persistence.
• https://*/* high Broad host access across all HTTPS sites; necessary for dApp injection but high capability.
• http://localhost/* low Dev/local node access; common for crypto wallet dApp development support.
• http://127.0.0.1/* low Loopback only; same rationale as localhost.
• http://0.0.0.0/* low Loopback bind address; limited practical scope.

Pillar Scores

Bookkeeping