Top Risks

• jquery@1.10.2 has 3 moderate XSS CVEs (fixed in 3.5.0); no CSP amplifies XSS exploitability via dynamic script creation and innerHTML sinks.
• known-bad-host hit on github.com (URLHaus malware_download); extension lists github.com as external JS host.
• New tab override with *://*/* host access gives full cross-origin read capability on every page the user visits.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing: scores maximum privacy risk.
• Free-webmail developer (gmail.com) with no verified publisher badge and no business domain; install_url_hijack detected on install.

Evidence

• known-bad-host hit on github.com crx threat_intel cve_findings_raw: URLHaus malware_download flag on github.com; extension bundles external JS from github.com.
• jquery@1.10.2 bundled — 3 moderate CVEs + no CSP crx CVE-2015-9251, CVE-2019-11358, CVE-2020-11023 all unpatched; no CSP present; DOM-manipulation lib triggers CVE v2 amplifier ×1.5.
• script_src_dynamic in jquery + eval_user_input in angular crx Dynamic script tag creation and direct eval in vendored libs with no CSP guard — remote code loading risk.
• New tab override + broad host permissions manifest chrome_url_overrides.newtab + host_permissions *://*/* grants full cross-origin capability from new tab context.
• Privacy policy is generic Google account policy store scope_extension=false, data_collection=true, third_party_sharing=true — policy admits sharing without scoping to this extension.
• Free-webmail developer, no verified publisher store developer_email=james.schubert@gmail.com; verified_publisher=false; no business domain resolvable.
• install_url_hijack detected crx install_url_hijack=true; target=null. onInstalled opens a URL — exact destination unconfirmed but pattern is present.
• Stale update + CVEs + MV3 (triple-stale partially applicable) store Last updated Oct 2023 (~19 months); CVEs unfixed; vendored libs well below fix versions — no remediation signal.

CVE Exposures (14)

Permissions Breakdown

• storage low Standard key-value storage; low standalone risk.
• favicon low Read-only favicon access; minimal risk.
• host_permissions: *://*/* high Broad host access across all URLs enables reading/injecting on any site.
• host_permissions: file:/// medium Access to local filesystem URLs; can read local files if content scripts used.
• chrome_url_overrides: newtab medium Replaces new tab page; high-visibility surface, monetization vector.

Pillar Scores

Scoring History

Bookkeeping