Top Risks

• Content script runs on <all_urls> — full page access on every site visited.
• jQuery 3.2.1 bundles 3 medium CVEs (XSS); library unpatched since 2018.
• Privacy policy fetched but not scoped to this extension and admits data collection without retention disclosure.
• Developer email is free-webmail (gmail) with no developer name; identity unverifiable.
• install_url_hijack=true: onInstalled opens a third-party URL — unsolicited redirect on install.

Evidence

• content_scripts_all_urls manifest content_scripts matches <all_urls> — injected into every page despite narrow declared permissions.
• jquery_cve_triple crx jquery@3.2.1 carries CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 (all medium); fixed_in 3.5.0.
• install_url_hijack crx install_url_hijack=true; extension opens external URL on install — classic monetization/redirect signal.
• privacy_policy_unscoped api Policy at darktheme.org is fetched, admits data_collection=true but scope_extension=false and retention=false.
• free_webmail_no_dev_name store developer_email=quanlimetunduc@gmail.com; developer_name empty; identity unverifiable.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; discounts partially offset reputation risk.
• no_csp manifest csp_present=false on MV3; no extra script isolation beyond browser defaults.
• obfuscation_clean crx obfuscation_score=0.0; code_findings_raw empty; no dynamic eval or exfil patterns detected.

CVE Exposures (3)

Permissions Breakdown

• storage low Stores user preferences; low risk.
• contextMenus low Adds right-click menu items; minimal risk.
• webNavigation medium Observes navigation events across all tabs; some privacy surface.
• content_scripts:<all_urls> high Injects scripts into every page; broad reach, high capability.

Pillar Scores

Bookkeeping