Top Risks

• angular@1.8.3 carries 1 high + 5 medium CVEs (XSS, ReDoS) with no fixed version available; AngularJS is EOL.
• Privacy policy fetched but scope_extension=false and admits third-party data sharing — worst-case Privacy pillar (10.0).
• cookies + <all_urls> host access on 500K-user AI extension; every page the user visits is in scope.
• CSP allows unsafe-eval on extension pages and sandbox; dynamic script creation found in code.
• Uninstall URL redirects to gingersoftware.com; monetization signals (GTM, GA) in CSP and external hosts.

Evidence

• angular@1.8.3 EOL with 9 CVEs (1 high, 5 medium, 3 low); no fixed_in version crx CVE-2024-21490 (high), CVE-2022-25869 (XSS moderate), plus 7 others — all unfixed.
• CSP unsafe-eval on extension_page and sandbox crx script-src includes 'unsafe-eval' in both extension_page and sandbox CSP directives.
• Privacy policy admits data collection + third-party sharing but not scoped to extension store scope_extension=false, data_collection=true, third_party_sharing=true per classification.
• cookies permission paired with host_permissions https://*/ and http://*/ manifest Broad cookie access across all sites; AI extension processes page text on all URLs.
• script_src_dynamic and function_constructor found in JS crx Dynamic script element creation in runtime JS; new Function() in writer.vendor.js.
• dom_sink_innerhtml_userctrl in multiple content script files crx innerHTML sinks in content.min.js, definitionPopup/main.js, popup.min.js, writer.min.js.
• uninstall_url_hijack to gingersoftware.com crx chrome.runtime.setUninstallURL points to https://www.gingersoftware.com/extension/uninstall?
• verified_publisher + is_featured_by_google; no sibling clusters; domain resolves store Positive signals cap reputation discount; 0c applies due to monetization_hits nonempty.

CVE Exposures (9)

Permissions Breakdown

• tabs medium Allows reading tab URLs and metadata across all open tabs.
• background medium Persistent background execution; increases attack surface lifetime.
• cookies high Can read/write cookies; paired with broad host access is HIGH×1.2 risk.
• storage low Local extension storage; low standalone risk.
• https://*/ high Broad host access to all HTTPS sites; combined with cookies is critical surface.
• http://*/ high Broad host access to all HTTP sites; extends reach to insecure origins.
• content_scripts <all_urls> high Content script injected into every page; full DOM read/write on all sites.

Pillar Scores

Bookkeeping