Top Risks

• Uninstall and install URL hijacks both present — typical low-quality game-shell monetization pattern
• Privacy policy hosted on cloudapi.stream CDN, not scoped to this extension, admits third-party sharing
• jquery@3.2.1 bundles 3 medium-severity XSS CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); unfixed
• Sandbox CSP allows unsafe-eval and unsafe-inline, weakening XSS mitigations where jQuery CVEs apply
• Free-webmail dev (Gmail) with no verified publisher and privacy policy on third-party CDN domain

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled and uninstall URL hooks set; install target is popup/index.html — game-portal shell fingerprint.
• privacy_policy_not_scoped store Policy at cdn.cloudapi.stream/game_privacy.html: scope_extension=false, data_collection=false, third_party_sharing=true.
• jquery@3.2.1 CVEs crx 3 medium CVEs (CVE-2019-11358/11022/11023); fixed_in 3.5.0, bundled version 3.2.1 — not patched.
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-eval and unsafe-inline on script-src, elevating XSS risk from jQuery CVEs.
• free_webmail_dev_no_verified_publisher store Developer email nadejdinv@gmail.com; no verified publisher badge; no business domain.
• 8_external_js_hosts crx js_external_hosts lists 8 domains (cloudapi.stream, codecanyon.net, createjs.com, etc.) for a simple game ext.
• low_install_count store Only 82 installs — extremely small blast radius reduces impact but not intent risk.
• manifest_name_localization_placeholder manifest manifest_name and manifest_description are i18n placeholders only; actual content not inspectable.

CVE Exposures (3)

Pillar Scores

Bookkeeping