Top Risks

• Critical CVE-2021-23358 in underscore 1.8.3 (RCE) with no CSP
• Privacy policy admits data collection + 3rd-party sharing without extension scope
• Broad permissions: webRequest, cookies, <all_urls> host access
• Rating 3.0 suggests user dissatisfaction or issues
• DOM-XSS sinks in content scripts with no CSP protection

Evidence

• critical_cve crx underscore@1.8.3 vulnerable to CVE-2021-23358 (RCE) and CVE-2026-27601 (DoS)
• privacy_policy_fail api Policy fetched but not scoped to extension, admits data collection and 3rd-party sharing
• broad_permissions manifest webRequest, cookies, <all_urls>, scripting across all sites
• install_url_hijack crx onInstalled opens third-party URL
• no_csp crx No content_security_policy defined with DOM-XSS sinks present
• dom_xss_sinks crx 3 innerHTML sinks from user-controlled variables in content scripts
• low_rating store Rating 3.0 across unspecified count
• developer_recognized store cyberark.com domain resolves, established cert history (4805 days)

CVE Exposures (2)

Permissions Breakdown

• webRequest high Intercept/observe all network traffic across all sites.
• cookies high Read/modify cookies for all domains.
• host_permissions:http://*/* high Broad host access to all HTTP sites.
• host_permissions:https://*/* high Broad host access to all HTTPS sites.
• content_scripts:<all_urls> high Inject scripts into every webpage.
• declarativeNetRequest medium Block/modify network requests declaratively.
• tabs medium Access tab metadata and URLs.
• clipboardWrite medium Write to system clipboard.
• scripting medium Programmatic script injection.
• storage low Local extension storage.
• contextMenus low Add right-click menu items.
• offscreen low Offscreen document processing.
• unlimitedStorage low Bypass storage quota limits.
• webRequestAuthProvider low Provide auth credentials for requests.
• webNavigation low Monitor navigation events.

Pillar Scores

Bookkeeping