Top Risks

• Uninstall and install URL hijacks detected — extension redirects users on install/uninstall events.
• Privacy policy hosted on CDN subdomain, not scoped to this extension; third-party sharing admitted.
• jQuery 3.2.1 bundles 3 moderate-severity CVEs (XSS); unfixed version below 3.5.0.
• Sandbox CSP permits unsafe-eval and unsafe-inline, weakening XSS mitigations inside sandbox.
• Developer uses free Gmail, no verified publisher badge; extension is a low-install game shell.

Evidence

• install_url_hijack crx install_url_hijack=true; target=popup/index.html — triggers on-install navigation.
• uninstall_url_hijack crx uninstall_url_hijack=true; target=null — runtime.setUninstallURL() called without confirmed target.
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src, weakening XSS protection.
• cve_jquery crx jquery@3.2.1 carries CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (moderate XSS); fixed in 3.5.0.
• privacy_policy_off_domain store Privacy policy on cdn.cloudapi.stream; scope_extension=false, third_party_sharing=true.
• free_webmail_dev store Developer email nadejdinv@gmail.com; no verified publisher; no business domain.
• js_external_hosts crx 11 external JS hosts referenced (codecanyon, goo.gl, cloudapi.stream, etc.) in a simple game extension.
• low_install_game_shell store 144 installs, slot-machine game category, manifest uses __MSG_ placeholders suggesting template origin.

CVE Exposures (3)

Pillar Scores

Bookkeeping