Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 (Arbitrary Code Execution); not patched.
• High CVE-2026-27601 in underscore@1.8.3 (DoS via recursion); not patched.
• Privacy policy fetched but scope_extension==false and admits 3rd-party data sharing without extension-specific scope → +10.0 privacy pillar.
• No developer name listed in store; email domain toggl.com resolves but publisher not verified.
• Uninstall URL hijack flag set true; though target null, signal warrants review.

Evidence

• cve_critical crx underscore@1.8.3 bundles CVE-2021-23358 (Arbitrary Code Execution); fixed in 1.12.1.
• cve_high crx underscore@1.8.3 bundles CVE-2026-27601 (DoS recursion); fixed in 1.13.8.
• privacy_scope_missing store Policy at toggl.com/legal/track/privacy/ does not scope to this extension; admits 3rd-party sharing.
• uninstall_url_hijack crx uninstall_url_hijack==true; target URL null so hijack destination unknown.
• cookies_permission manifest cookies permission declared; host-scoped to toggl.com only, limiting blast radius.
• featured_by_google store Extension marked is_featured_by_google=true; positive trust signal.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; no active malicious behaviour detected.
• external_hosts crx 12 external JS hosts including momentjs.com, radix-ui.com, robwu.nl outside toggl.com cluster.

CVE Exposures (2)

Permissions Breakdown

• alarms low Schedules timer reminders; expected for time tracker.
• background low Keeps timer running in background; expected.
• contextMenus low Adds right-click timer controls; low risk.
• idle low Detects idle to pause timer; expected function.
• notifications low Timer alerts; expected for productivity tool.
• scripting medium Can inject scripts into pages; scoped to toggl.com host perms.
• storage low Local config/state; standard.
• cookies high Can read cookies; host-scoped to toggl.com only, reduces blast radius.
• offscreen low Offscreen document for audio/DOM; low risk.
• unlimitedStorage low Extended local storage for time entries; expected.

Pillar Scores

Scoring History

Bookkeeping