Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — High or Low Casino Game [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack + install URL hijack flags monetization/tracking shell pattern
• Privacy policy on CDN subdomain (cloudapi.stream), not scoped to this extension, mentions 3rd-party sharing
• jquery@3.2.1 bundles 3 moderate CVEs (XSS); not patched to fixed_in versions
• Free-webmail developer (gmail), no developer name, no verified publisher

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hooks present; classic monetization/redirect shell fingerprint.
• free_webmail_no_dev_name store Developer nadejdinv@gmail.com, no developer_name field; unverified, no business identity.
• privacy_policy_cdn_not_scoped store Policy at cdn.cloudapi.stream; scope_extension=false, third_party_sharing=true, data_collection=false.
• jquery_cve_triple crx jquery@3.2.1 carries CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all moderate XSS); fixed in 3.5.0.
• sandbox_csp_unsafe manifest Sandbox CSP allows unsafe-inline and unsafe-eval on script-src; elevates XSS risk from bundled jQuery CVEs.
• 11_external_js_hosts crx js_external_hosts lists 11 domains including goo.gl, cloudapi.stream, codecanyon.net; wide third-party surface.
• empty_permissions manifest No declared permissions or host_permissions; extension is a self-contained popup game reducing CAPABILITY risk.
• low_installs store 573 installs; blast radius is low but URL hijack signals and gmail dev merit scrutiny.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — High or Low Casino Game [credential-theft] + malext.io malicious_extension_sentry; score 4.43 -> 6.93 (+2.5 cap 2.5).

CVE Exposures (3)

Pillar Scores

Bookkeeping