Top Risks

• Critical CVE in bundled underscore@1.8.3 (CVE-2021-23358 Arbitrary Code Execution) — unpatched library in active crypto wallet.
• Google's generic privacy policy used — scope_extension=false, data_collection=true, third_party_sharing=true: D(v3.5) → +10.0 privacy score.
• webRequest + content_scripts on <all_urls> gives broad passive network observation and full DOM access across every site.
• Multiple new Function() calls including WASM bridge and dynamic <script> creation raise code execution surface area.
• No developer name listed; privacy policy points to Google's own policy — no extension-scoped data handling disclosure.

Evidence

• CVE critical: underscore@1.8.3 (CVE-2021-23358) crx Arbitrary Code Execution; fixed_in 1.12.1. Bundled version 1.8.3 confirmed in background.bundle.js.
• CVE high: underscore@1.8.3 (CVE-2026-27601) crx DoS via unlimited recursion in _.flatten/_.isEqual; fixed_in 1.13.8.
• Privacy policy is Google's account policy store URL myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true.
• content_scripts on <all_urls> manifest Scripts injected on all http/https pages combined with webRequest = full sitewide reach.
• function_constructor + script_src_dynamic crx 8 function_constructor hits across WASM bridge and polyfills; 1 dynamic script element creation in ui-popup bundle.
• No developer name store developer_name is empty string; only dev@onekey.so available for identity.
• 12 distinct external JS hosts crx Includes ledger.com APIs, github.com, links.ethers.org, mozilla.github.io — >3 distinct registrable domains.
• react@16.13.1 bundled crx React below 16.4 threshold cited in rubric; version 16.13.1 is above 16.4 so no CVE amplifier triggered.

CVE Exposures (2)

Permissions Breakdown

• offscreen low Creates offscreen document; low direct risk but used for WASM/crypto ops here.
• identity low OAuth identity access; no scopes declared.
• activeTab medium Access to current tab on user gesture; limited scope.
• storage low Local key/value storage.
• unlimitedStorage low Extended storage quota; low risk alone.
• webRequest high Can observe all network requests across all sites visited.
• notifications low Desktop notification display only.
• idle low Detects idle state; minimal risk.
• sidePanel low Side panel UI surface; low risk.
• contextMenus low Adds right-click menu items; low risk.
• <all_urls> (content_scripts) high Content scripts injected on every http/https page — full DOM access sitewide.

Pillar Scores

Bookkeeping