Top Risks

• browsingData + scripting + <all_urls>: can read/delete all browsing data and inject code on every site.
• Last updated Dec 2022 (~29mo stale) — unpatched, abandoned risk.
• Privacy policy on circlereader.com does not scope to this extension and lacks retention disclosure.
• Free-webmail developer (gmail) with no verified business identity.
• 12 external hosts including Chinese CDN/content providers (baidu, weibo, zhihu, thepaper) without CSP.

Evidence

• HIGH permissions: browsingData + scripting + <all_urls> manifest browsingData(HIGH) + scripting(HIGH) + <all_urls> host+content_script = severe combined capability.
• Free-webmail developer, no business domain store developer_email=wenguang.fe@gmail.com; brand_mention.developer_domain=gmail.com; no org name.
• No CSP, MV3 but 12 external JS hosts crx csp_present=false; js_external_hosts has 12 entries across CA/IN/SG geos including Chinese platforms.
• Stale: 29 months since update store last_updated=2022-12-07; ~29mo no update → +8.5 maintenance score.
• Privacy policy not scoped to extension, no retention api fetched=true, scope_extension=false, data_collection=false, retention=false → +9.0 privacy.
• function_constructor in 4 widget JS files crx new Function() present in app.js, news.js, notice.js, setting.js — dynamic code execution risk.
• dom_sink_innerhtml_userctrl in react.js, no CSP crx innerHTML sink + csp_present=false + function_constructor also present → elevated DOM-XSS risk.
• verified_publisher=true but staleness cap applies store months_since_update=29 >18 → invariant 0c caps verified-publisher discount to -1.0 on reputation.

Permissions Breakdown

• browsingData high Can delete browsing history, cookies, cache — high-impact data erasure/exfil surface.
• tabs medium Access to tab URLs and metadata across all open tabs.
• scripting high Execute arbitrary scripts on any page when combined with <all_urls> host permission.
• <all_urls> (host_permissions) high Broad host access; amplifies browsingData and scripting to every site visited.
• <all_urls> (content_scripts_matches) high Content script injected on every page — persistent DOM-level access across all sites.

Pillar Scores

Bookkeeping