Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 (arbitrary code execution) + high CVE in same lib, no CSP amplifier applies.
• Five moderate jQuery XSS CVEs in bundled jquery@1.7.2 running inside Gmail context with no CSP protection.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension.
• Content scripts inject into Gmail (mail.google.com) giving read/write access to email content.
• Install URL hijack opens mail.google.com on install; 12 external JS hosts referenced (legacy source comments in old jQuery/underscore).

Evidence

• critical_cve_underscore crx underscore@1.8.3 has CVE-2021-23358 (critical, ACE) and CVE-2026-27601 (high, DoS); both unfixed in bundled version.
• multiple_medium_cves_jquery crx jquery@1.7.2 has 5 moderate XSS CVEs; no CSP present; jquery is DOM-manipulation lib — v2 amplifier applies.
• no_csp manifest content_security_policy is null (MV3 default strict but no explicit CSP declared); amplifies jquery CVE risk.
• privacy_policy_unscoped_with_3rd_party_sharing store Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 per v3.5 rule D.
• function_constructor_findings crx new Function() used in jquery.js and underscore.js; +2.5 code quality; dom_sink_innerhtml also present.
• install_url_hijack store onInstalled opens https://mail.google.com/ — intent appears benign (product operates on Gmail) but flagged.
• geo_diversity api JS hosts in 4 countries (CA, IE, IN, US); category not VPN/etc. — +1.5 network.
• no_developer_name store developer_name is empty string; +1.0 reputation; email domain resolves and looks legitimate.

CVE Exposures (7)

Permissions Breakdown

• host_permissions: https://*.rightinbox.com/ low Scoped to developer's own domain only; used for sync/API calls.
• content_scripts: http://mail.google.com/* + https://mail.google.com/* + https://inbox.google.com/* medium Injects scripts into Gmail; broad read/write access to email UI content.

Pillar Scores

Bookkeeping