Top Risks

• jquery@3.2.1 has 3 medium-severity CVEs (XSS); not patched to fixed version 3.5.0
• Extension not updated in 26 months — stale, unpatched vulnerabilities will persist
• Privacy policy hosted on CDN domain (cdn.cloudapi.stream), not scoped to this extension; third-party sharing admitted
• Developer uses free-webmail Gmail with no verified business identity
• Sandbox CSP allows unsafe-inline and unsafe-eval, weakening XSS mitigations

Evidence

• jquery_cve_medium_x3 crx jquery@3.2.1 bundles CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all medium XSS); fixed_in 3.5.0
• stale_extension store Last updated July 2024, 26 months ago — well into zombie territory for CVE-bearing libs
• privacy_policy_cdn_unscoped store Policy at cdn.cloudapi.stream; scope_extension=false, third_party_sharing=true, retention=false
• free_webmail_dev store Developer email nashprom.info@gmail.com; no verified publisher badge; no business domain
• sandbox_csp_unsafe manifest Sandbox CSP permits unsafe-inline and unsafe-eval on script-src, weakening extension sandbox isolation
• install_url_hijack crx install_url_hijack=true targeting popup/index.html (internal page — low severity but present)
• js_external_hosts crx Extension references codecanyon.net, createjs.com, www.opensource.org as external JS hosts
• v3_privacy_policy_d crx scope_extension=false AND data_collection=false → +9.0 privacy; third_party_sharing=true adds +1.0 but pillar is 9.0

CVE Exposures (3)

Pillar Scores

Bookkeeping