Top Risks

• jquery@3.2.1 carries 3 moderate XSS CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); no CSP amplifies risk.
• Extension is 28 months stale — abandoned; known-vulnerable jQuery will not be patched.
• Privacy policy is short (470 chars), not scoped to this extension, third-party sharing unstated; data-handling opaque.
• Uninstall URL hijack to firebase-hosted page; install URL also hijacked to internal help.html.
• 6 external JS hosts contacted (firebaseapp, google-analytics, github, jqueryscript.net); no CSP to constrain them.

Evidence

• cve_moderate_x3_jquery crx jquery@3.2.1 bundled; 3 moderate CVEs (XSS). Fixed in 3.5.0. No CSP present — v2 CVE amplifier ×1.5 applies.
• no_csp_mv3 manifest content_security_policy is null; MV3 default blocks remote scripts but no explicit CSP heightens CVE risk.
• months_stale_28 store Last updated Feb 2024; 28 months since update triggers +8.5 maintenance score.
• privacy_policy_not_scoped api Policy fetched (470 chars); scope_extension=false, data_collection=false — generic, not scoped to extension.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to https://find-and-replace-f6588.firebaseapp.com/uninstall (3rd party).
• 6_external_js_hosts crx facebook.github.io, firebaseapp.com, git.io, github.com, google-analytics.com, jqueryscript.net in js_external_hosts.
• dom_sink_innerhtml_userctrl crx src/widget/bundle.js assigns innerHTML from variable — DOM-XSS sink; CVEs in bundled jQuery worsen this.
• mozmail_email_alias store Developer email c862mbanl@mozmail.com is a Mozilla relay alias — identity not directly verifiable.

CVE Exposures (3)

Permissions Breakdown

• activeTab medium Access to current tab content on user action; limited scope but enables DOM read/write.
• contextMenus low Adds right-click menu items; no data access beyond trigger.
• storage low Local extension storage; limited blast radius.
• scripting medium Injects scripts into active tab; combined with activeTab enables DOM manipulation.

Pillar Scores

Bookkeeping