Top Risks

• jquery@3.3.1 bundles 3 moderate XSS CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); no CSP amplifies risk.
• Developer uses free-webmail email (gmail) with no developer name listed.
• last_updated missing — maintenance posture unknown; stale library version reinforces concern.
• description_promise flags is_shell_pattern=true; extension appears to be a game wrapper.
• Privacy policy third_party_silence=true; no explicit statement on third-party data sharing.

Evidence

• cve_moderate_x3_jquery crx jquery@3.3.1 has 3 moderate CVEs (XSS); fixed_in 3.5.0. No CSP present on MV3 extension.
• no_csp_present manifest content_security_policy is null; no CSP defined, raising DOM-XSS exposure from CVE-laden jQuery.
• dom_sink_innerhtml_userctrl crx Clock.js assigns timer variables to innerHTML — DOM-XSS sink, elevated by missing CSP + CVEs.
• free_webmail_no_devname store developer_email=deben3@gmail.com; developer_name is empty. Reputation penalty applies.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reputation discounts applied.
• shell_pattern_game store description_promise.is_shell_pattern=true; game wrapper extension with 1M installs.
• maintenance_unknown store last_updated and months_since_update are null; stale library version suggests possible abandonment.
• privacy_third_party_silence api Privacy policy fetched, scoped, retention present, but third_party_silence=true; +1.0 applied.

CVE Exposures (3)

Permissions Breakdown

• storage low Used to save game progress/settings locally; minimal risk.

Pillar Scores

Bookkeeping