Top Risks

• jquery@3.2.1 bundles 3 medium-severity CVEs (XSS), unfixed for 27+ months
• Extension stale 27 months with no update to patch known vulnerable library
• Privacy policy hosted on CDN subdomain (cdn.cloudapi.stream), not scoped to this extension, admits third-party sharing
• Developer uses free Gmail address with no verified business identity
• Sandbox CSP allows unsafe-inline and unsafe-eval, increasing XSS risk from vulnerable jQuery

Evidence

• cve_jquery crx jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed in 3.5.0, not updated.
• stale_extension store Last updated June 25, 2024; 27 months ago. Maintenance pillar score 8.5.
• privacy_policy_inadequate api Policy fetched but scope_extension=false, data_collection=false, third_party_sharing=true. Not scoped to this extension.
• gmail_developer store Developer email nashprom.info@gmail.com; free webmail, no verified business domain.
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src, elevating jQuery XSS exploitability.
• no_permissions manifest No declared permissions or host_permissions; minimal capability surface — game extension.
• js_external_hosts crx 5 external JS hosts referenced: codecanyon.net, createjs.com, github.com, steffe.se, opensource.org.
• install_url_hijack crx install_url_hijack=true; onInstalled opens popup/index.html (internal, not 3rd party — low severity).

CVE Exposures (3)

Pillar Scores

Bookkeeping