Top Risks

• 6 medium CVEs in bundled jQuery (v3.3.1 and v1.9.1); both below fixed versions for XSS vulns.
• Two innerHTML DOM-XSS sinks found; combined with vulnerable jQuery raises XSS exploit risk.
• Developer uses free Gmail account with no verified business identity.
• Privacy policy hosted on GitHub Pages (free hosting); third-party sharing disclosed but scope is limited.
• 10 external JS hosts in CSP including jsdelivr.com CDN — supply-chain risk if CDN compromised.

Evidence

• cve_moderate_jquery_3.3.1 crx jQuery 3.3.1 bundled with 3 moderate CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed in 3.5.0.
• cve_moderate_jquery_1.9.1 crx jQuery 1.9.1 bundled (in bootstrap.min.js) with 3 moderate CVEs including CVE-2015-9251; fixed in 1.12.2.
• dom_xss_sink crx innerHTML used with variables in popup.js and auth.js; vulnerable jQuery present increases exploit severity.
• gmail_developer_no_business store Developer email viacheslav.mukha@gmail.com; no developer name listed; no verified business domain.
• verified_publisher_featured store Extension is verified publisher AND featured by Google — provides accountability signal.
• external_js_hosts crx CSP lists 10 external hosts including jsdelivr.com CDN; potential supply-chain vector.
• privacy_policy_classification api Policy fetched, scoped to extension, discloses data collection, third-party sharing, and retention.
• no_bad_hosts_no_affiliate_monetization api No bad host hits, no affiliate or monetization hits detected in threat_intel.

CVE Exposures (6)

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• identity medium Used for Google OAuth; can access identity tokens. Scoped to accounts.google.com.
• notifications low Push desktop notifications; limited abuse potential.
• https://accounts.google.com/* medium Host permission for Google auth; scoped narrowly to auth domain.
• https://www.googleapis.com/* medium Host permission for Google APIs; scoped to googleapis.com only.

Pillar Scores

Bookkeeping