Top Risks

• Bundled underscore@1.8.3 carries critical CVE-2021-23358 (arbitrary code execution)
• High-severity DoS CVE-2026-27601 in same underscore build
• innerHTML DOM-XSS sinks across 14 marketplace bundles with CVEs present
• Generic privacy policy admits data collection + 3rd-party sharing, not extension-scoped
• cookies permission enables session handling across marketplace accounts

Evidence

• cve_critical crx underscore@1.8.3 CVE-2021-23358 critical ACE, fixed 1.12.1
• cve_high crx underscore@1.8.3 CVE-2026-27601 high DoS via recursion, fixed 1.13.8
• dom_xss_sink crx innerHTML user-controlled sink in 14 bundles; CSP present but CVEs escalate to +2.0
• privacy_generic api Policy fetched but scope_extension=false, admits collection + 3rd-party sharing
• verified_publisher store Verified publisher; selleraider.com resolves, domain est. 2020, no throwaway signals
• permissions manifest cookies (high) + storage (low); no host_permissions, no content_scripts declared
• maintenance store Updated Oct 2026 (0 months); MV3; CSP present; no obfuscation
• threat_intel_clean api No bad hosts, no monetization/affiliate hits, no siblings, no review red flags

CVE Exposures (2)

Permissions Breakdown

• storage low Standard local state persistence; minimal risk.
• cookies high Cookie read/write; session theft possible but no host_permissions limits blast radius.

Pillar Scores

Bookkeeping