Top Risks

• MANAGEMENT PERMISSION: extension can enumerate and disable other installed extensions (incl. security and privacy tools).
• management + <all_urls> + webRequest: can surveil and manipulate all browsing traffic and other extensions
• Privacy policy fetch failed — data practices unknown; 10.0 privacy pillar score
• jquery@2.1.3 bundles 4 medium CVEs (XSS); version well below fixed_in 3.5.0
• 23 months since last update; extension is approaching zombie status with 1M installs

Evidence

• broad_host_access manifest http://*/*, https://*/*, <all_urls> all declared; content_scripts also on <all_urls>.
• management_permission manifest management permission allows listing/disabling other extensions — unusually powerful for a video downloader.
• privacy_policy_unfetchable crx privacy_policy_classification.fetched=false (HTTPError); policy content unknown — scored 10.0.
• cve_jquery_moderate_x4 crx jquery@2.1.3 has CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; none fixed at bundled version.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in jquery.js; CSP present but CVEs exist → elevated to +2.0 per FIX B.
• stale_extension store Last updated July 2024; 23 months since update with 1M installs — approaching triple-stale threshold.
• low_rating store Rating 3.0; rating_count not provided; no review red flags matched.
• geo_diversity crx 3 JS host countries (CA, IN, US); below threshold of 4 for penalty — no geo-diversity penalty applied.

CVE Exposures (4)

Permissions Breakdown

• tabs medium Can read tab URLs and metadata across all open tabs.
• scripting high Injects scripts into pages; combined with <all_urls> very broad.
• webRequest high Intercepts all network requests across all URLs.
• unlimitedStorage low Local storage only; no direct exfil risk.
• management high Can list, enable, or disable other extensions.
• downloads medium Can initiate and manage file downloads.
• storage low Stores extension data locally.
• http://*/* high Broad host access to all HTTP sites.
• https://*/* high Broad host access to all HTTPS sites.
• <all_urls> high Redundant universal host access; maximises reach.
• content_scripts:<all_urls> high Content script injected into every page visited.

Pillar Scores

Scoring History

Bookkeeping