Top Risks

• underscore@1.8.3 bundles critical CVE-2021-23358 (Arbitrary Code Execution) and high CVE-2026-27601 (DoS); not updated past fixed versions.
• Broad host permissions (<all_urls> + scripting) allow script injection into every page visited by 6M users.
• Privacy policy fetched but scope_extension==false with data_collection+third_party_sharing true — admits broad data sharing without scoping to this extension.
• 5 external JS hosts (unpkg.com, github.com, emscripten.org, vuejs.org, v3-migration.vuejs.org) create supply-chain exposure.
• No developer display name; rating 3.9 is below positive threshold for a 6M-install extension.

Evidence

• critical_cve crx underscore@1.8.3 has CVE-2021-23358 (ACE, critical); fixed in 1.12.1 — bundled version unfixed.
• high_cve crx underscore@1.8.3 has CVE-2026-27601 (DoS, high); fixed in 1.13.8 — bundled version unfixed.
• broad_host_permissions manifest <all_urls> + *://*/* paired with scripting permission enables page-wide script injection.
• privacy_policy_scope_mismatch api Policy fetched (28k chars) but scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 5 distinct external hosts referenced: unpkg.com, github.com, emscripten.org, vuejs.org, v3-migration.vuejs.org.
• no_developer_name store developer_name is empty string; reduces accountability signal.
• featured_by_google store is_featured_by_google=true; partially mitigates reputation concerns.
• content_scripts_google_drive_mail manifest Content scripts run on mail.google.com, drive.google.com, outlook.live.com — sensitive data surfaces.

CVE Exposures (3)

Permissions Breakdown

• alarms low Scheduling only, no data access.
• storage low Local extension data persistence.
• tabs medium Can read tab URLs and titles across sessions.
• activeTab medium Access to current tab content on user action.
• offscreen low Offscreen document for media processing; low standalone risk.
• scripting high Injects scripts into pages; combined with <all_urls> is high risk.
• unlimitedStorage low Storage quota only; no extra data access.
• tabCapture high Captures audio/video of any tab — core screen recorder function but high capability.
• desktopCapture high Captures entire desktop screen and audio.
• webNavigation medium Observes navigation events across tabs.
• notifications low Display notifications only.
• system.display low Read display metadata for recording config.
• <all_urls> high Broad host access enabling scripting on every site.
• *://*/* high Redundant broad host permission amplifying <all_urls> reach.

Pillar Scores

Bookkeeping