Top Risks

• cookies + scripting + *://*/* permits full cross-site credential and session token harvest.
• jquery@3.1.1 carries 3 medium CVEs (XSS); no CSP; DOM-manipulation lib amplifier applies.
• Privacy policy is Google's generic account policy — no scope, no extension-specific disclosure.
• No developer name; small install base (141) with high-tier permissions raises tail-attack surface.
• External JS loaded from getbootstrap.com and www.linkedin.com without a CSP to restrict execution.

Evidence

• broad_host_cookies_scripting manifest permissions=[cookies,scripting] + host_permissions=[*://*/*] enables full cross-origin cookie read and JS injection.
• generic_privacy_policy store Privacy URL points to myaccount.google.com/privacypolicy — scope_extension=false, does not cover this extension.
• cve_jquery_3.1.1 crx jquery@3.1.1 in vendor/jquery/jquery.min.js has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023).
• no_csp_dom_lib_combo crx csp_present=false + vulnerable jQuery amplifies CVE exposure per v2/v3 rules (×1.5 CVE amplifier).
• external_js_hosts crx js_external_hosts=[getbootstrap.com, www.linkedin.com]; no CSP restricting script-src.
• no_developer_name store developer_name is empty; no verified publisher badge; no Google featured badge.
• small_install_high_perm_anomaly api install_perm_anomaly.small_install_high_perm=true; 141 installs with HIGH-tier cookie+scripting+all_urls.
• domain_age_established api paradisiak.com age 2191 days, 35 certs, resolves=true, looks_throwaway=false — mitigates throwaway risk.

CVE Exposures (3)

Permissions Breakdown

• cookies high Combined with *://*/* host access enables full cross-site cookie exfiltration.
• activeTab low Scoped to user-invoked tab; lower risk in isolation.
• scripting high Allows arbitrary JS injection into any page via broad host permission.
• *://*/* high Unrestricted host access amplifies cookies+scripting to full-web reach.

Pillar Scores

Bookkeeping