Netskope Extension Risk

Detail view · rubric v3.6
← Back to catalog

SAML Chrome Panel

paijfdbeoenhembfhkhllainmocckace
Risk Score
4.57
Risk Level: Medium
Recommendation: 🟡 MEDIUM RISK — review
Category DeveloperTools
Installs 100,000
Rating 3.8
Last updated —
Manifest version MV3
CSP present ❌ no
Developer mlai@mlai.org
Verified publisher ❌ no
Featured by Google ✅ yes
Privacy policy link
Web Store open ↗

Top Risks

  • Generic Google privacy policy does not disclose what this extension collects; handles sensitive SAML tokens.
  • jQuery 2.2.4 bundled without CSP enables known XSS exploits (CVE-2020-11022/11023).
  • Angular 1.0.7 contains high-severity prototype pollution (CVE-2019-10768) and multiple XSS vectors.
  • eval_user_input code pattern present in vendor library increases exploitability of DOM-based attacks.
  • Broad host access (*://*/*) combined with vulnerable libraries creates large attack surface.

Evidence

  • host_permissions manifest Universal host access (*://*/*) declared for content scripts
  • privacy_policy api Generic Google privacy policy; scope_extension=false, data_collection=true
  • cve_angular api angular@1.0.7 with 11 CVEs including high-severity prototype pollution
  • cve_jquery api jquery@2.2.4 with 4 XSS CVEs; fixed in 3.5.0
  • csp_missing manifest No content_security_policy defined; amplifies DOM-XSS risk from outdated libs
  • code_eval crx eval_user_input detected in angular.min.js vendor file
  • verified_badge store Featured by Google badge present; publisher not individually verified

CVE Exposures (14)

CVELibrarySeverity Fixed inSummary
angular@1.0.7 angular@1.0.7 medium 1.6.0 Cross-Site Scripting via JSONP
CVE-2023-26117 angular@1.0.7 medium — angular vulnerable to regular expression denial of service via the $resource ser
CVE-2023-26116 angular@1.0.7 medium — angular vulnerable to regular expression denial of service via the angular.copy(
CVE-2019-10768 angular@1.0.7 high 1.7.9 angular Prototype Pollution vulnerability
CVE-2025-0716 angular@1.0.7 low — AngularJS improperly sanitizes SVG elements
CVE-2020-7676 angular@1.0.7 medium 1.8.0 Angular vulnerable to Cross-site Scripting
CVE-2024-8373 angular@1.0.7 low — AngularJS allows attackers to bypass common image source restrictions
CVE-2022-25869 angular@1.0.7 medium — Angular (deprecated package) Cross-site Scripting
CVE-2023-26118 angular@1.0.7 medium — angular vulnerable to regular expression denial of service via the <input type="
CVE-2019-14863 angular@1.0.7 medium 1.5.0-beta.1 AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attribute
CVE-2019-11358 jquery@2.2.4 medium 3.4.0 XSS in jQuery as used in Drupal, Backdrop CMS, and other products
CVE-2020-11022 jquery@2.2.4 medium 3.5.0 Potential XSS vulnerability in jQuery
CVE-2020-11023 jquery@2.2.4 medium 3.5.0 Potential XSS vulnerability in jQuery
CVE-2015-9251 jquery@2.2.4 medium 1.12.2 Cross-Site Scripting (XSS) in jquery

Permissions Breakdown

  • scripting medium Allows dynamic script injection into pages. Broad host access increases exposure.
  • activeTab low Scoped to user gesture on active tab only. Lower risk than broad host access.
  • *://*/* high Universal host access for content scripts. Justified for SAML DevTools panel inspecting any SSO flow.

Pillar Scores

Permissions2.40
Reputation3.00
Network1.50
Webstore1.00
Maintenance0.00
Privacy9.00
Code Quality4.50
CVE Exposure7.50

Bookkeeping

Rubric v3.6
Scored at 2026-10-22 12:12
Listing SHA 4511888b64e0…
Force block — not fired
Score recovered no
Elapsed —