Top Risks

• Critical CVE in bundled underscore@1.8.3 (arbitrary code execution) plus high-severity DoS CVE; no CSP amplifies risk.
• Uninstall and install URL hijacking to cloudapi.stream; privacy policy hosted on same CDN admits data collection and 3rd-party sharing without extension scope.
• Free-webmail developer (gmail) with no verified identity; privacy policy on cloudapi.stream CDN is a generic game policy, not scoped to this extension.
• Broad <all_urls> host access combined with scripting permission and multiple unrelated third-party host permissions (top.rodeo, wheel/mines.cloudapi.stream).
• new Function() constructor found in content-script; no CSP present on MV3 extension; js_external_hosts include top.rodeo and cloudapi.stream.

Evidence

• critical_cve_bundled_lib crx underscore@1.8.3 has CVE-2021-23358 (critical, arbitrary code exec) and CVE-2026-27601 (high, DoS); fixed in 1.12.1/1.13.8.
• uninstall_and_install_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true pointing to https://cloudapi.stream/install/?reason=
• privacy_policy_game_cdn_generic store Privacy policy at cdn.cloudapi.stream/game_privacy_2025.html; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email kiev3381917@gmail.com; no verified publisher; no business domain.
• unrelated_host_permissions manifest Host perms include wheel.cloudapi.stream, mines.cloudapi.stream, top.rodeo — unrelated to color-tool functionality.
• function_constructor_in_content_script crx new Function() constructor detected in js/content-script-combo.js and lib/underscore.js.
• small_install_high_perm_anomaly store Only 4 installs but has HIGH-tier permissions including <all_urls> and scripting.
• no_csp_mv3 manifest content_security_policy is null/absent; amplifies CVE risk for DOM-manipulation libs.

CVE Exposures (2)

Permissions Breakdown

• tabs medium Access to tab URLs/titles; combined with <all_urls> elevates risk.
• scripting high Allows dynamic script injection into any page via <all_urls>.
• storage low Local data persistence; low standalone risk.
• offscreen low Enables background DOM operations; low but can assist exfil.
• <all_urls> high Grants access to every site the user visits; broadest host permission.
• https://www.googleapis.com/* medium Google API access; could be used to access user Google data.
• https://wheel.cloudapi.stream/* high Unknown third-party domain under cloudapi.stream; likely game/monetization endpoint.
• https://mines.cloudapi.stream/* high Unknown third-party domain under cloudapi.stream; likely game/monetization endpoint.
• https://top.rodeo/* high Unknown third-party domain; unrelated to stated color-tool function.

Pillar Scores

Bookkeeping