Netskope Extension Risk

Detail view · rubric v3.6
← Back to catalog

Vucazap

meophpndbjjojmledlkjganjiijhlleo
Risk Score
6.04
Risk Level: High
Recommendation: 🚫 BLOCK
Category Productivity
Installs —
Rating —
Last updated —
Manifest version MV3
CSP present ✅ yes
Developer —
Verified publisher ❌ no
Featured by Google ❌ no
Privacy policy link
Web Store open ↗

Top Risks

  • Critical & high CVEs in bundled lodash, axios, property-expr, path-to-regexp at unknown versions (prototype pollution, SSRF, command injection).
  • Privacy policy is generic Google account policy with no extension-specific scope; data_collection and third_party_sharing both true.
  • Content script runs on WhatsApp Web and posts to unknown vucaadm.vucasolution.com.br backend — chat data exfil surface.
  • No developer identity, no install count, no last-updated date — unverifiable provenance and possibly abandoned.
  • js_external_hosts includes git.io (a URL shortener) and localhost references — unusual network surface for a messaging helper.

Evidence

  • cve_critical_lodash crx lodash/lodash-es@unknown: CVE-2019-10744 (critical prototype pollution), CVE-2021-23337 (high command injection); version unverifiable.
  • cve_critical_property_expr crx property-expr@unknown: CVE-2020-7707 critical prototype pollution; fixed_in 2.0.3 — current version unknown.
  • cve_high_axios crx axios@unknown: 17 CVEs including SSRF, header injection, credential leak, ReDoS; multiple high/moderate severities.
  • privacy_policy_generic store Policy URL is Google account policy: scope_extension=false, data_collection=true, third_party_sharing=true. Triggers D variant (+10).
  • function_constructor crx new Function('return this') found in minified bundle — dynamic code execution risk.
  • no_developer_identity store developer_name, developer_email, install_count, last_updated all missing — unverifiable identity and maintenance state.
  • external_host_git_io crx js_external_hosts includes git.io (URL shortener) and localhost — unexpected for a WhatsApp messaging extension.
  • whatsapp_backend_exfil_surface manifest Content script on web.whatsapp.com with axios-based requests to vucaadm.vucasolution.com.br backend — chat data exposure risk.

CVE Exposures (39)

CVELibrarySeverity Fixed inSummary
CVE-2021-23337 lodash@unknown high 4.17.21 Command Injection in lodash
CVE-2026-4800 lodash@unknown high 4.17.21 Command Injection in lodash
CVE-2018-16487 lodash@unknown high 4.17.11 Prototype Pollution in lodash
CVE-2025-13465 lodash@unknown moderate 4.18.0 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and
CVE-2026-2950 lodash@unknown moderate 4.18.0 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and
CVE-2018-3721 lodash@unknown moderate 4.17.5 Prototype Pollution in lodash
CVE-2019-10744 lodash@unknown critical 4.17.12 Prototype Pollution in lodash
CVE-2020-7707 property-expr@unknown critical 2.0.3 Prototype Pollution in property-expr
CVE-2024-45296 path-to-regexp@unknown high 0.1.13 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple r
CVE-2026-4867 path-to-regexp@unknown high 0.1.13 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple r
CVE-2024-52798 path-to-regexp@unknown high 0.1.12 path-to-regexp contains a ReDoS
CVE-2021-23337 lodash-es@unknown high 4.17.21 Command Injection in lodash
CVE-2026-4800 lodash-es@unknown high 4.17.21 Command Injection in lodash
CVE-2025-13465 lodash-es@unknown moderate 4.18.0 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and
CVE-2026-2950 lodash-es@unknown moderate 4.18.0 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and
CVE-2019-10744 lodash-es@unknown critical 4.17.14 Prototype Pollution in lodash
CVE-2025-62718 axios@unknown moderate 1.15.0 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
CVE-2019-10742 axios@unknown high 0.18.1 Denial of Service in axios
CVE-2026-25639 axios@unknown high 1.13.5 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
CVE-2020-28168 axios@unknown moderate 0.21.1 Axios vulnerable to Server-Side Request Forgery
CVE-2026-42034 axios@unknown moderate 1.15.1 Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
CVE-2026-42039 axios@unknown moderate 1.15.1 Axios: unbounded recursion in toFormData causes DoS via deeply nested request da
CVE-2026-42035 axios@unknown high 1.15.1 Axios: Header Injection via Prototype Pollution
CVE-2026-44490 axios@unknown moderate 1.16.0 axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in ax
CVE-2021-3749 axios@unknown high 0.21.2 axios Inefficient Regular Expression Complexity vulnerability
CVE-2026-40175 axios@unknown moderate 1.15.0 Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
CVE-2026-44496 axios@unknown high 1.16.0 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
CVE-2026-44486 axios@unknown high 1.16.0 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-eval
CVE-2025-27152 axios@unknown high 1.8.2 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute U
CVE-2026-42038 axios@unknown moderate 1.15.1 Axios: no_proxy bypass via IP alias allows SSRF
CVE-2026-67316 axios@unknown moderate 1.18.0 Axios: Prototype pollution gadgets can alter axios request construction
CVE-2026-44487 axios@unknown high 1.16.0 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS
CVE-2026-42033 axios@unknown high 1.15.1 Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and
CVE-2026-44492 axios@unknown high 1.16.0 axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowin
CVE-2026-42043 axios@unknown high 1.15.1 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC
CVE-2026-42036 axios@unknown moderate 1.15.1 Axios: HTTP adapter streamed responses bypass maxContentLength
CVE-2026-42041 axios@unknown moderate 1.15.1 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus`
CVE-2026-42040 axios@unknown low 1.15.1 Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
CVE-2026-42042 axios@unknown moderate 1.15.1 Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXS

Permissions Breakdown

  • tabs medium Can enumerate open tabs; scoped to activeTab context reduces risk.
  • scripting medium Allows JS injection into pages; host_permissions limit scope to whatsapp.com.
  • activeTab low Grants transient access to currently active tab only.
  • https://vucaadm.vucasolution.com.br/vucaServices/vucaZap/api.php medium Specific backend endpoint; data sent to unknown third-party server.
  • https://web.whatsapp.com/ medium Content scripts run on WhatsApp Web; can read messages and DOM.

Pillar Scores

Permissions3.30
Reputation6.50
Network2.00
Webstore1.00
Maintenance5.00
Privacy10.00
Code Quality2.50
CVE Exposure10.00

Bookkeeping

Rubric v3.6
Scored at 2026-08-31 04:53
Listing SHA c18f902feaca…
Force block — not fired
Score recovered no
Elapsed —