Top Risks

• jQuery 1.9.1 bundles 3 medium CVEs (XSS); fixed versions available since 2019–2020; library not updated.
• dom_sink_innerhtml_userctrl in readability.js combined with CVEs elevates DOM-XSS risk on all visited pages.
• Free-webmail developer (gmail) with no developer name listed; privacy policy not scoped to this extension.
• install_url_hijack and uninstall_url_hijack flags set; onInstalled opens third-party URL.
• Privacy policy admits data collection but not scoped to extension; no retention period disclosed.

Evidence

• jquery_cve_bundle crx jquery@1.9.1 bundles CVE-2019-11358, CVE-2020-11023, CVE-2015-9251 (all medium XSS); fixed in 3.5.0.
• install_url_hijack crx install_url_hijack=true; onInstalled opens third-party URL — minor but noted monetization signal.
• uninstall_url_hijack crx Uninstall redirects to https://forms.gle/wVjk1u9mnn9PoNA39 — survey page, low threat but flagged.
• free_webmail_dev_no_name store Developer email ryzalyusoff@gmail.com; developer_name empty; verified_publisher=true mitigates partially.
• privacy_policy_not_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=false, retention=false.
• dom_sink_plus_cve crx dom_sink_innerhtml_userctrl in readability.js + active jQuery CVEs elevate DOM-XSS risk.
• function_constructor crx new Function() in pdf.js and pdf.worker.js — PDF.js feature-detect pattern, lower exploitation risk.
• broad_host_access manifest <all_urls> host_permissions + content_scripts on all URLs; justified for ReaderMode category.

CVE Exposures (3)

Permissions Breakdown

• scripting medium Can inject scripts into pages; moderate risk, expected for ReaderMode.
• tabs medium Access to tab URLs and metadata across all tabs.
• activeTab low Scoped to user-activated tab; lower risk.
• contextMenus low UI-only right-click menu; minimal risk.
• webNavigation medium Can observe all navigation events; moderate privacy surface.
• storage low Local storage for settings; low risk.
• <all_urls> (host_permissions) high Broad host access on all URLs; content_scripts also match <all_urls>. Partially justified for ReaderMode.

Pillar Scores

Bookkeeping