Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 enables arbitrary code execution; unfixed.
• Known-bad-host hit: web.archive.org resolves to URLHaus malware_download IP in JS host list.
• Privacy policy fetch failed (HTTP error); policy adequacy cannot be verified — scored as no policy.
• No CSP on MV3 extension with function_constructor finding in underscore; code execution risk elevated.
• No developer name listed; developer identity limited to email domain linangdata.com.

Evidence

• critical_cve_bundled_lib crx underscore@1.8.3 bundles CVE-2021-23358 (Arbitrary Code Execution); fixed_in 1.12.1, not updated.
• known_bad_host crx web.archive.org appears in js_external_hosts; URLHaus flags IP 154.216.19.139 as malware_download.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched==false (fetch_error:HTTPError); treated as no policy.
• function_constructor_no_csp crx new Function() in underscore-min.js; csp_present==false amplifies code execution risk.
• no_developer_name store developer_name is empty string; only identity signal is info@linangdata.com.
• external_hosts_broad crx 12 distinct external JS hosts including languagetool.org, github.com, stackoverflow.com, web.archive.org.
• verified_publisher store verified_publisher==true; applies reputation discount but capped due to bad-host hit (invariant 0c/E).
• high_cve_underscore crx CVE-2026-27601 high-severity DoS in underscore@1.8.3; fixed_in 1.13.8, currently unfixed.

CVE Exposures (3)

Permissions Breakdown

• contextMenus low Adds right-click menu items; no data access on its own.

Pillar Scores

Bookkeeping