Top Risks

• Privacy policy hosted on CDN domain (cloudapi.stream), not scoped to this extension, admits third-party sharing.
• Uninstall URL hijack flag set — extension registers a custom uninstall URL with external redirect.
• Install URL hijack opens popup/index.html on install, unusual for a minimal game extension.
• Free-webmail developer (gmail), no developer name, no verified business presence.
• innerHTML sink on navigator.userAgent in supportcheck.js — potential DOM-XSS vector.

Evidence

• uninstall_url_hijack crx Extension sets uninstall URL (target null but flag true) — suspicious behavior for a simple game.
• install_url_hijack crx onInstalled opens popup/index.html; flagged as install_url_hijack.
• privacy_policy_scope api Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true.
• free_webmail_dev store Developer email viktornadiezhdin@gmail.com; developer_name empty; no business website.
• dom_sink_innerhtml_userctrl crx popup/scripts/supportcheck.js: innerHTML set from navigator.userAgent string — DOM-XSS sink.
• sandbox_csp_unsafe manifest Sandbox CSP allows unsafe-inline and unsafe-eval on script-src; main extension pages CSP is strict.
• js_external_hosts crx 10 external JS hosts referenced including cloudapi.stream, goo.gl, harrytheo.com — broad reach.
• verified_publisher store Verified publisher badge present; partially mitigates reputation risk but does not cover webstore anomalies.

Pillar Scores

Bookkeeping