Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Hidden Kitty Game [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy hosted on CDN domain (cloudapi.stream), not scoped to this extension, admits third-party sharing.
• Uninstall URL hijack flag set — extension registers a custom uninstall URL with external redirect.
• Install URL hijack opens popup/index.html on install, unusual for a minimal game extension.
• Free-webmail developer (gmail), no developer name, no verified business presence.

Evidence

• uninstall_url_hijack crx Extension sets uninstall URL (target null but flag true) — suspicious behavior for a simple game.
• install_url_hijack crx onInstalled opens popup/index.html; flagged as install_url_hijack.
• privacy_policy_scope api Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true.
• free_webmail_dev store Developer email viktornadiezhdin@gmail.com; developer_name empty; no business website.
• dom_sink_innerhtml_userctrl crx popup/scripts/supportcheck.js: innerHTML set from navigator.userAgent string — DOM-XSS sink.
• sandbox_csp_unsafe manifest Sandbox CSP allows unsafe-inline and unsafe-eval on script-src; main extension pages CSP is strict.
• js_external_hosts crx 10 external JS hosts referenced including cloudapi.stream, goo.gl, harrytheo.com — broad reach.
• verified_publisher store Verified publisher badge present; partially mitigates reputation risk but does not cover webstore anomalies.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Hidden Kitty Game [credential-theft] + malext.io malicious_extension_sentry; score 3.74 -> 6.24 (+2.5 cap 2.5).

Pillar Scores

Bookkeeping