Top Risks

• Extension stale 26 months; bundled jQuery 3.2.1 carries 3 medium XSS CVEs (unfixed, fixed_in >= 3.4).
• Sandbox CSP allows unsafe-inline and unsafe-eval, amplifying jQuery XSS risk.
• Privacy policy hosted on CDN subdomain (cdn.cloudapi.stream), not scoped to this extension; third_party_sharing admitted.
• Developer uses free Gmail address; no verified publisher status; no business identity.
• install_url_hijack flag set (onInstalled opens popup/index.html) — minor but anomalous for a slot game.

Evidence

• cve_medium_x3_jquery crx jquery@3.2.1 has CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all moderate); fixed in 3.4-3.5, not updated.
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src, enabling script injection in sandboxed context.
• stale_26mo store Last updated July 2024; 26 months since update — maintenance score 8.5.
• privacy_policy_unscoped_cdn api Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false but third_party_sharing=true. Privacy score 9.0.
• free_webmail_dev store Developer email nashprom.info@gmail.com; no verified publisher; no business domain. Reputation +1.5.
• install_url_hijack crx install_url_hijack=true targeting popup/index.html; low-severity but flags non-standard onInstalled behavior.
• zero_permissions manifest No declared permissions or host_permissions — extension is a self-contained popup slot game. Permissions pillar 0.0.
• js_external_hosts_7 crx 7 external JS hosts listed (createjs.com, codecanyon.net etc.) but no outbound requests detected; no bad/monetization hits.

CVE Exposures (3)

Pillar Scores

Bookkeeping