Top Risks

• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• cookies + <all_urls> + scripting + management: can exfil session tokens, inject code, and disable other extensions.
• Privacy policy fetched but admits data collection and third-party sharing without scoping to this extension (10.0).
• install_url_hijack + uninstall_url_hijack: opens third-party URLs on install/uninstall without disclosed target.
• new Function() constructor and dynamic <script src> injection in bundled code raise arbitrary-code-execution risk.

Evidence

• cookies+<all_urls>+scripting+management manifest HIGH-permission triple with broad host access — can read all cookies, inject scripts, manage other extensions.
• newtab_override manifest chrome_url_overrides.newtab set to pages/newtab/newtab.html — replaces new-tab page.
• install_url_hijack+uninstall_url_hijack crx Both install and uninstall URL hijack flags true; target URLs null (unknown destination).
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic admission of sharing.
• cve_jquery_3.3.1 crx 3 moderate CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023) in jquery@3.3.1; fixed_in 3.5.0.
• code_function_constructor+script_src_dynamic crx new Function() in scripts/validate-wallpaper-tags.js and vendor/LargeLocalStorage.js; dynamic script injection in vendor/head.min.js.
• 12_external_js_hosts crx 12 distinct external hosts including s3.amazonaws.com, everhelper.pro, geoloc.tempest.com, google-analytics.com.
• no_developer_name store developer_name is empty string; identity anchored only to email developer@apptitudeglobal.com.

CVE Exposures (3)

Permissions Breakdown

• storage low Standard local state persistence.
• unlimitedStorage low Extended quota; low direct risk.
• tabs medium Can read tab URLs and titles across all tabs.
• contextMenus low Adds right-click menu items; limited impact.
• history medium Full read/write access to browsing history.
• cookies high Read/write all cookies; paired with <all_urls> is critical.
• management high Can enumerate, disable or uninstall other extensions.
• scripting high Programmatic script injection into any page given <all_urls>.
• <all_urls> (host) high Broad host access amplifies cookies, scripting, and history.
• newtab override medium Replaces new-tab page; prime real-estate for monetization.

Pillar Scores

Bookkeeping