Top Risks

• Critical CVE-2021-23358 (arbitrary code execution) in bundled underscore@1.8.3; not updated to fixed version 1.12.1.
• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing==true: admits broad data sharing without extension-specific scoping.
• cookies + <all_urls> + webRequest + scripting combination grants near-total access to all browsing sessions.
• new Function() constructor used in 4 injected content-script files increases attack surface if input taint reaches those paths.
• 8M installs amplify blast radius of any future supply-chain compromise or unpatched CVE exploitation.

Evidence

• verified_publisher+featured store Verified publisher badge and featured by Google; reputation floor 2.0 applied; discount capped at -1.0 per v3.5 invariant 0c (cve_findings_raw non-empty).
• cve_critical_underscore crx underscore@1.8.3 bundles CVE-2021-23358 (critical, ACE); fixed_in 1.12.1 not met.
• cve_high_underscore crx underscore@1.8.3 bundles CVE-2026-27601 (high, DoS via recursion); fixed_in 1.13.8 not met.
• privacy_policy_scope_gap api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 rule D).
• broad_host_high_perms manifest <all_urls> with cookies+webRequest+scripting; justified-broad discount applied for Screenshot category.
• function_constructor_x4 crx new Function() pattern in 4 injected JS files (recordConsoleEvents*, recordNetworkEvents*).
• atlassian_external_hosts crx JS references atlassian/loom-owned hosts (cdn.loom.com, www.atlassian.com, support.atlassian.com); no bad hosts detected.
• no_developer_name store developer_name is empty string; email domain loom.com resolves and is not throwaway.

CVE Exposures (2)

Permissions Breakdown

• system.memory low Read system memory stats; needed for screen recording performance monitoring.
• activeTab low Access current tab on user action only; limited scope.
• alarms low Schedule background tasks; low standalone risk.
• contextMenus low Add right-click menu items; low risk.
• cookies high Read/write cookies across origins; paired with <all_urls> host access raises risk significantly.
• desktopCapture high Capture screen, window, or tab content; core function but high capability.
• scripting high Inject scripts into pages; broad with <all_urls> host access.
• storage low Local extension storage; low risk.
• system.cpu low Read CPU stats; low risk.
• system.display low Query display info for capture; low risk.
• tabCapture high Capture tab audio/video stream; core recording function but high capability.
• webNavigation medium Observe navigation events; used for integration triggers.
• webRequest high Observe all network requests; combined with <all_urls> is high risk.
• <all_urls> high Broad host access enabling cookies+scripting+webRequest across all sites.

Pillar Scores

Scoring History

Bookkeeping