Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — 3D Soccer Slot Machine [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack flagged despite null target — suspicious lifecycle interception attempt.
• Install URL hijack redirects to popup/index.html on install — unusual install-time navigation.
• Privacy policy hosted on CDN (cloudapi.stream), not scoped to this extension, admits third-party sharing.
• Free-webmail developer (gmail.com), no developer name listed, no verified business identity.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target is null but flag is true — lifecycle hijack attempt.
• install_url_hijack crx onInstalled opens popup/index.html; coded as install URL hijack in scan.
• free_webmail_dev_no_name store Developer email nadejdinv@gmail.com; developer_name is empty; no business website.
• privacy_policy_not_scoped api Policy fetched from CDN cdn.cloudapi.stream; scope_extension=false, third_party_sharing=true.
• sandbox_csp_unsafe_eval manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src; risky for sandboxed pages.
• external_js_hosts crx 11 external hosts in JS: bnjmnt4n.now.sh, goo.gl, codecanyon.net, harrytheo.com, cloudapi.stream etc.
• verified_publisher store verified_publisher=true; provides mild reputation relief but gmail address limits discount.
• low_install_count store Only 238 installs; limited blast radius but low scrutiny.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — 3D Soccer Slot Machine [credential-theft] + malext.io malicious_extension_sentry; score 3.67 -> 6.17 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping