Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Foosball [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack flagged (uninstall_url_hijack=true) — typical monetization-shell signal.
• Install URL hijack flagged (install_url_hijack=true, target=popup/index.html) — opens page on install.
• Privacy policy hosted on CDN domain (cdn.cloudapi.stream), not scoped to this extension; third_party_sharing admitted.
• jquery@3.2.1 bundles 3 medium-severity CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); not updated to fixed version.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; target null but flag true — monetization shell indicator.
• install_url_hijack crx onInstalled opens popup/index.html — minor but flagged alongside uninstall hijack.
• jquery@3.2.1 CVEs crx 3 medium CVEs in bundled jquery@3.2.1; fixed in 3.5.0; library not updated.
• privacy_policy_not_scoped store Policy at cdn.cloudapi.stream: scope_extension=false, third_party_sharing=true → +9.0 privacy.
• free_webmail_developer store Developer email kiev3381917@gmail.com; no verified publisher; no business website.
• sandbox_unsafe_eval manifest CSP sandbox allows unsafe-inline and unsafe-eval on script-src; extension_pages CSP is strict.
• geo_diversity crx JS hosts span 4 countries (CA,IT,NL,US); Entertainment category → +1.5 network.
• no_permissions manifest permissions[], host_permissions[], content_scripts_matches[] all empty — minimal capability surface.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Foosball [credential-theft] + malext.io malicious_extension_sentry; score 4.04 -> 6.54 (+2.5 cap 2.5).

CVE Exposures (3)

Pillar Scores

Bookkeeping