Top Risks

• Privacy policy hosted on cdn.cloudapi.stream is not scoped to this extension and admits third-party sharing without specifying what data is collected.
• Three medium-severity jQuery@3.2.1 CVEs (XSS); library version below fixed_in 3.5.0.
• Uninstall URL hijack and install URL hijack flags set — onInstalled/onUninstalled events redirecting user browser.
• Free-webmail developer (nadejdinv@gmail.com) with no verifiable business identity or verified-publisher status.
• Sandbox CSP allows unsafe-inline and unsafe-eval, widening jQuery XSS attack surface within sandboxed context.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hijack flags are true; install target is popup/index.html (internal), uninstall target is null but flag is set.
• privacy_policy_scope_mismatch + third_party_sharing crx Policy at cdn.cloudapi.stream: scope_extension=false, data_collection=false, third_party_sharing=true → v3.5D: +9.0 privacy.
• jquery CVE trio (medium severity) crx jquery@3.2.1 has 3 medium CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); fixed_in 3.5.0, not updated.
• sandbox CSP unsafe-eval + unsafe-inline manifest sandbox CSP allows unsafe-inline and unsafe-eval on script-src, amplifying jQuery XSS risk in sandboxed pages.
• free-webmail developer, no verified publisher store Developer email nadejdinv@gmail.com, verified_publisher=false, is_featured_by_google=false; +1.5 reputation.
• js_external_hosts present in CRX crx 7 external JS hosts listed (bnjmnt4n.now.sh, cloudapi.stream, createjs.com, mths.be, etc.) but no outbound confirmed.
• very low install count (6) store Only 6 installs; tail-attack-surface anomaly not triggered (no HIGH-tier permissions), but low-signal provenance.
• operator_cluster sibling_count=0 api No sibling extensions under same fingerprint; no additional cluster risk.

CVE Exposures (3)

Pillar Scores

Bookkeeping