RevROI
nmidcdbnmhggenoknphfaanmphbbfkid
Risk Score
4.34
Risk Level:
Medium
Recommendation:
🟡 MEDIUM RISK — review
Top Risks
- 17 CVEs incl 2 high-severity AngularJS XSS/ReDoS; jQuery 2.0.0/1.9.1 well below fixed versions.
- No CSP declared, amplifying DOM-XSS exposure from jquery<3.5 (v2 x1.5 multiplier applied).
- 26 months unmaintained — vulnerable libs will not be patched; abandonment risk.
- AngularJS internals use eval/new Function; strict CSP absent so injected scripts can run.
- Privacy policy scoped but omits data retention and admits third-party sharing.
Evidence
- cve_bundled_libs crx angular@1.8.2 (2 high, 5 med, 2 low) + jquery@2.0.0/1.9.1 (7 med); 17 findings, fixed versions not met.
- csp_missing crx content_security_policy null; jquery<3.5 DOM-XSS amplifier x1.5 applied to CVE pillar.
- maintenance_stale store Last updated Aug 2024, 26 months ago; stale with unfixed CVEs.
- code_eval crx eval_user_input and function_constructor inside bundled angular.min.js.
- reputation_verified store Verified publisher + Google featured; domain cleartheshelf.com resolves, cert since 2018; floor 2.0.
- privacy_policy store Scoped policy fetched; admits data collection and 3rd-party sharing; no retention disclosed.
- host_scope manifest Host permissions limited to cashback/shopping sites + own domain + mixpanel; category-consistent.
- threat_intel_clean api No bad-host/monetization/affiliate hits; no operator siblings; no review red flags.
CVE Exposures (17)
| CVE | Library | Severity | Fixed in | Summary |
|---|---|---|---|---|
| CVE-2019-11358 | jquery@2.0.0 | medium | 3.4.0 | XSS in jQuery as used in Drupal, Backdrop CMS, and other products |
| CVE-2020-11022 | jquery@2.0.0 | medium | 3.5.0 | Potential XSS vulnerability in jQuery |
| CVE-2020-11023 | jquery@2.0.0 | medium | 3.5.0 | Potential XSS vulnerability in jQuery |
| CVE-2015-9251 | jquery@2.0.0 | medium | 1.12.2 | Cross-Site Scripting (XSS) in jquery |
| CVE-2023-26117 | angular@1.8.2 | medium | — | angular vulnerable to regular expression denial of service via the $resource ser |
| CVE-2023-26116 | angular@1.8.2 | medium | — | angular vulnerable to regular expression denial of service via the angular.copy( |
| CVE-2024-21490 | angular@1.8.2 | high | — | angular vulnerable to super-linear runtime due to backtracking |
| CVE-2026-11998 | angular@1.8.2 | high | — | Angular's deprecated package has a Cross-Site Scripting issue |
| CVE-2025-0716 | angular@1.8.2 | low | — | AngularJS improperly sanitizes SVG elements |
| CVE-2022-25844 | angular@1.8.2 | medium | — | angular vulnerable to regular expression denial of service (ReDoS) |
| CVE-2024-8372 | angular@1.8.2 | low | — | AngularJS allows attackers to bypass common image source restrictions |
| CVE-2024-8373 | angular@1.8.2 | low | — | AngularJS allows attackers to bypass common image source restrictions |
| CVE-2022-25869 | angular@1.8.2 | medium | — | Angular (deprecated package) Cross-site Scripting |
| CVE-2023-26118 | angular@1.8.2 | medium | — | angular vulnerable to regular expression denial of service via the <input type=" |
| CVE-2019-11358 | jquery@1.9.1 | medium | 3.4.0 | XSS in jQuery as used in Drupal, Backdrop CMS, and other products |
| CVE-2020-11023 | jquery@1.9.1 | medium | 3.5.0 | Potential XSS vulnerability in jQuery |
| CVE-2015-9251 | jquery@1.9.1 | medium | 1.12.2 | Cross-Site Scripting (XSS) in jquery |
Permissions Breakdown
- storage low Local settings persistence; minimal risk.
- activeTab low Temporary access to active tab on user gesture only.
- identity low OAuth identity; no scopes declared.
- identity.email low Reads user's email address; minor PII exposure.
- contextMenus low Adds right-click menu entries.
- scripting medium Programmatic script injection into pages.
- tabs medium Read tab URLs/titles; browsing-activity visibility.
Pillar Scores
Permissions2.80
Reputation2.00
Network1.50
Webstore0.00
Maintenance6.00
Privacy2.00
Code Quality4.50
CVE Exposure9.00
Bookkeeping
Rubric v3.6
Scored at 2026-10-26 14:56
Listing SHA
25e1e12ffda1…
Force block
— not fired
Score recovered
no
Elapsed
—