Top Risks

• Uninstall URL hijack and install URL hijack both present — classic traffic-monetization shell signals.
• Privacy policy hosted on cloudapi.stream CDN, not scoped to this extension; third_party_sharing=true, data_collection=false → scored +9.0.
• 4 medium-severity jQuery CVEs (2.0.3 far below fixed_in 3.5.0); sandbox CSP allows unsafe-eval+unsafe-inline amplifying XSS risk.
• Free-webmail Gmail developer with no verified publisher badge and 9 diverse external JS hosts including goo.gl shortener.
• Sandbox CSP includes unsafe-eval and unsafe-inline on script-src, undermining isolation of bundled vulnerable jQuery.

Evidence

• uninstall_url_hijack+install_url_hijack crx Both uninstall and install URL hijacks flagged; install_url_target=popup/index.html. Classic low-quality shell pattern.
• privacy_policy_not_scoped store Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true. Generic CDN-hosted policy.
• jquery_cves crx jquery@2.0.3 has 4 medium CVEs (CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed_in 3.5.0.
• sandbox_csp_unsafe crx Sandbox CSP allows unsafe-eval and unsafe-inline on script-src, amplifying XSS risk from vulnerable jQuery.
• free_webmail_dev_no_verified store Developer email kiev3381917@gmail.com, no verified publisher, no featured badge. Reputation floor 6.5.
• 9_external_js_hosts crx js_external_hosts includes cloudapi.stream, goo.gl shortener, codecanyon.net, and 6 others — broad external surface.
• 35_installs_game_shell store Only 35 installs, manifest name/desc are i18n placeholders (__MSG_name__), consistent with bulk-generated game shell.
• webstore_uninstall_redirect crx uninstall_url_hijack=true adds +3.0 to Webstore pillar per rubric (numbered-alias/uninstall URL hijack cluster).

CVE Exposures (4)

Pillar Scores

Bookkeeping