Top Risks

• Uninstall URL hijack + install URL hijack flags monetization/tracking shell pattern
• Privacy policy on CDN subdomain (cloudapi.stream), not scoped to this extension, mentions 3rd-party sharing
• jquery@3.2.1 bundles 3 moderate CVEs (XSS); not patched to fixed_in versions
• Free-webmail developer (gmail), no developer name, no verified publisher
• 11 external JS hosts referenced; sandbox CSP allows unsafe-eval/unsafe-inline

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hooks present; classic monetization/redirect shell fingerprint.
• free_webmail_no_dev_name store Developer nadejdinv@gmail.com, no developer_name field; unverified, no business identity.
• privacy_policy_cdn_not_scoped store Policy at cdn.cloudapi.stream; scope_extension=false, third_party_sharing=true, data_collection=false.
• jquery_cve_triple crx jquery@3.2.1 carries CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all moderate XSS); fixed in 3.5.0.
• sandbox_csp_unsafe manifest Sandbox CSP allows unsafe-inline and unsafe-eval on script-src; elevates XSS risk from bundled jQuery CVEs.
• 11_external_js_hosts crx js_external_hosts lists 11 domains including goo.gl, cloudapi.stream, codecanyon.net; wide third-party surface.
• empty_permissions manifest No declared permissions or host_permissions; extension is a self-contained popup game reducing CAPABILITY risk.
• low_installs store 573 installs; blast radius is low but URL hijack signals and gmail dev merit scrutiny.

CVE Exposures (3)

Pillar Scores

Bookkeeping