Top Risks

• Critical CVE-2021-23358 (Arbitrary Code Execution) in bundled underscore@1.8.3, unfixed for 30+ months.
• High CVE-2026-27601 (DoS via recursion) in same underscore@1.8.3 bundle.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Extension not updated in 30 months; stale MV3 with known-vulnerable library presents growing attack surface.
• Developer name absent from listing; no verified-publisher discount applicable to privacy/CVE risk.

Evidence

• critical_cve crx underscore@1.8.3 has CVE-2021-23358 (ACE); fixed in 1.12.1; bundled at vulnerable version.
• high_cve crx underscore@1.8.3 has CVE-2026-27601 (DoS); fixed in 1.13.8; bundled at vulnerable version.
• stale_extension store Last updated December 2023; 30 months since update with unpatched CVEs.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• verified_publisher store verified_publisher=true but cap applies: months_since_update>18 and cve_findings_raw non-empty.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• external_hosts_diverse crx 12 external JS hosts including speech.microsoft.com, boosty.to, obsproject.com; geo diversity=1 country (IN).
• csp_present_mv3 manifest CSP present, MV3; connect-src scoped to translation endpoints and kappaflow.dev.

Permissions Breakdown

• notifications medium Can display notifications; low abuse potential standalone.
• storage low Local data persistence only.
• activeTab medium Access to current tab on user gesture; bounded scope.
• scripting medium Can inject scripts into active tab; medium risk without broad host access.
• system.display low Read display info; minimal abuse surface.
• contextMenus low Adds context menu items; low risk.
• sidePanel low Side panel UI; no data exfil risk alone.
• host:script.google.com medium Google Apps Script endpoint; scoped, translation plausible.
• host:translate.googleapis.com low Google Translate API; matches stated purpose.
• host:*.kappaflow.dev medium Developer domain; wildcard subdomain, potential future expansion.

Pillar Scores

Bookkeeping