Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware] (+2.0, capped).
• Privacy policy admits data collection and third-party sharing without scoping to this extension — scored at max privacy risk.
• Two outdated jQuery versions (3.2.1, 3.4.1) bundled with 5 moderate XSS CVEs, none fixed.
• Free-webmail developer (gmail) with no developer name raises accountability concerns.
• tabCapture + <all_urls> content scripts gives extension access to audio of every tab on every site.

Evidence

• privacy_policy_admits_collection_and_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D rule).
• bundled_vulnerable_jquery crx jquery@3.4.1 (CVE-2020-11022, CVE-2020-11023) and jquery@3.2.1 (CVE-2019-11358, +2) — 5 moderate CVEs unfixed.
• no_csp_plus_jquery_below_3.5 crx csp_present=false + jquery<3.5 triggers v2e +2.0 Code Quality penalty and CVE ×1.5 amplifier.
• gmail_developer_no_name store developer_email=alnortcc12@gmail.com, developer_name empty; free-webmail dev with no business identity.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discounts applied but capped per invariant 0c not triggered.
• host_permissions_all_urls_with_content_scripts manifest <all_urls> in both host_permissions and content_scripts_matches; broad reach for audio booster.
• external_hosts crx js_external_hosts: chrome.google.com, microsoftedge.microsoft.com, sound-ultimate.com; 2 countries (CA, US).
• large_install_base store 2,000,000 installs with rating 4.5; high blast radius if extension compromised or sold.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware]; score 4.26 -> 6.26 (+2.0 cap 2.5).

CVE Exposures (5)

Permissions Breakdown

• tabs medium Access to tab metadata; needed for audio capture coordination.
• tabCapture high Captures tab audio/video stream; core function but high capability.
• storage low Local settings persistence; standard low-risk.
• system.display low Read display info; minimal risk for UI layout.
• offscreen medium Off-screen document for audio processing; enables background execution.
• <all_urls> (host_permissions) high Content scripts injected on all URLs; broad reach paired with tabCapture.

Pillar Scores

Bookkeeping