Top Risks

• 20 months abandoned with 4 medium XSS CVEs in jquery-ui
• Privacy policy links to generic Google policy, admits data collection and 3rd party sharing without scope
• Broad host permissions (*://*/*, file:///*) on all websites
• Developer domain reunit.io does not resolve, no verified publisher
• No CSP allows CDN code execution via jsdelivr and fontawesome

Evidence

• abandonment store Last updated February 2025, 20 months stale
• cve_multiple_medium crx 4 medium-severity XSS CVEs in jquery-ui@1.12.1
• privacy_policy_generic api Links to myaccount.google.com generic policy, scope_extension=false, data_collection=true, third_party_sharing=true
• permissions_broad_host manifest host_permissions: *://*/* and file:///* with content_scripts on all HTTP/HTTPS
• dev_domain_dead api reunit.io does not resolve, verified_publisher=false
• network_remote_cdn crx 12 external hosts including jsdelivr and fontawesome CDNs, no CSP
• crypto_wallet_apis crx Calls Alchemy, Infura, Etherscan, BSCScan, Debank, CoinGecko
• low_installs store 3,000 installs, tail_attack_surface=true

CVE Exposures (4)

Permissions Breakdown

• storage low Local storage access for wallet state
• unlimitedStorage low Extended local storage quota
• *://*/* (host_permissions) high Broad host access to all websites
• file:///* (host_permissions) high Local file system access

Pillar Scores

Bookkeeping