Top Risks

• Privacy policy is not scoped to this extension and admits data collection + third-party sharing (score 10.0).
• Bundled jquery@2.2.4 carries 4 medium CVEs (XSS); version is far below fixed_in 3.5.0.
• new Function() constructor used in service worker and content scripts injected on all hotel/OTA/Google domains.
• <all_urls> host_permission enables content script on every site despite stated hotel-only scope.
• No developer name listed; privacy policy on dev domain lacks extension-specific data handling disclosure.

Evidence

• privacy_policy_not_extension_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → scores 10.0 per v3.5 rule D.
• jquery_cve_bundle crx jquery@2.2.4 bundled with 4 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023, CVE-2015-9251); fixed in 3.5.0.
• function_constructor_usage crx new Function() found in service_worker.js and two content scripts; code-quality risk.
• host_permission_all_urls manifest <all_urls> host permission with content scripts on hotel/OTA/Google domains globally.
• external_js_hosts crx Contacts api.rudderstack.com and cdn.rudderlabs.com (analytics/telemetry); consistent with Shopping category.
• no_developer_name store developer_name is empty string; no verified publisher badge.
• is_featured_by_google store Extension carries Google Featured badge, providing partial trust signal.
• content_scripts_on_google_domains manifest Content scripts declared on all google.* TLD variants; broad beyond hotel booking scope.

CVE Exposures (4)

Permissions Breakdown

• storage low Stores local extension state; standard for shopping extensions.
• tabs medium Can read tab URLs across sessions; needed for hotel-site detection.
• activeTab low Grants access to current tab only on user action; scoped.
• webNavigation medium Monitors navigation events across all tabs; used to trigger cashback logic.
• <all_urls> (host_permission) high Content scripts run on all URLs; broad beyond declared hotel/OTA domains.

Pillar Scores

Bookkeeping