Top Risks

• Privacy policy admits data collection and third-party sharing without extension-specific scope — worst-case privacy posture.
• 7 unpatched medium-severity CVEs in bundled jquery@3.3.1 and jquery-ui@1.12.1; DOM-XSS sink in sessions.js amplifies risk.
• DOM-XSS sink (innerHTML from variable) combined with no CSP and vulnerable jQuery raises exploitability.
• <all_urls> host access combined with history and tabs grants broad surveillance capability.
• Developer is free-webmail gmail address with no developer name disclosed, reducing accountability.

Evidence

• privacy_policy_admits_collection_and_sharing_no_scope api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D → +10.0 privacy.
• 7_medium_cves_in_jquery_jquery-ui crx jquery@3.3.1 (3 CVEs) and jquery-ui@1.12.1 (4 CVEs), all moderate, all below fixed_in versions.
• dom_xss_sink_no_csp crx innerHTML from user-controlled var in sessions.js; csp_present=false triggers +2.0 code quality penalty (FIX B).
• broad_host_access_with_history manifest <all_urls> + history + tabs; no justified-broad discount (not an adblock/VPN/privacy category).
• free_webmail_dev_no_name store developer_email=aureollabs@gmail.com, developer_name empty; gmail dev with no business website.
• verified_publisher_featured store verified_publisher=true, is_featured_by_google=true; discounts applied but capped where applicable.
• cve_amplifier_no_csp_jquery crx No CSP + medium CVEs in jQuery (DOM-manipulation lib): ×1.5 CVE amplifier applied → cve_pillar=5.0.
• rating_below_3_5 store Rating 3.4; count unknown. Below 4.5 threshold so no positive adjustment; insufficient data for negative trigger.

CVE Exposures (7)

Permissions Breakdown

• tabs medium Allows reading tab URLs/titles; reasonable for bookmark manager.
• history medium Full browsing history access; broad capability for a bookmark tool.
• bookmarks medium Core stated function; read/write all bookmarks.
• <all_urls> high Host access to all URLs; broad capability paired with history/tabs.
• storage low Local extension data storage; low risk.
• favicon low Read favicon URLs; minimal risk.
• sidePanel low UI surface only; low risk.

Pillar Scores

Bookkeeping