Top Risks

• jquery@3.2.1 bundles 3 moderate CVEs (XSS); not patched to fixed_in >= 3.5.0.
• Developer uses free Gmail; no developer name listed; identity unverifiable.
• Broad host access (<all_urls>) + scripting allows content injection on every site.
• Privacy policy scoped but lacks retention disclosure and third-party sharing clarity.
• v2 calibration: verified+featured but Gmail dev email limits reputation discount.

Evidence

• verified_publisher + featured store Extension holds verified publisher and featured badges; discounts applied but capped by Gmail dev email.
• developer_email_free_webmail store ludwigbarbara144@gmail.com — free Gmail account; no verified business domain.
• cve_jquery_moderate_x3 crx jquery@3.2.1 vulnerable to CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; fixed in 3.5.0.
• host_permissions_all_urls manifest <all_urls> host permission with scripting; justified for drawing-on-page category but high reach.
• csp_strict manifest CSP: script-src 'self'; object-src 'self' — no unsafe-eval, no remote CDN.
• privacy_policy_no_retention api Policy scoped to extension, discloses data collection, but retention period not stated.
• code_quality_clean crx No obfuscation (score 0.0), no code_findings_raw hits, 5 JS files scanned.
• threat_intel_clean api No bad_host_hits, monetization_hits, affiliate_hits; single geo (US); 0 operator siblings.

CVE Exposures (3)

Permissions Breakdown

• alarms low Scheduling only; no data access risk.
• scripting medium Can inject scripts into pages; paired with <all_urls> raises capability.
• storage low Local extension storage; limited risk.
• <all_urls> (host_permissions) high Broad host access; scripting can operate on every site the user visits.
• <all_urls> (content_scripts) high Content scripts injected on all URLs; same surface as host_permissions—anti-double-count applied.

Pillar Scores

Bookkeeping