Top Risks

• No last_updated date — maintenance unknown, extension may be abandoned with no security patches.
• Privacy policy is Google's generic account policy — not scoped to this extension at all; admits data collection and 3rd-party sharing.
• Bundled jquery@1.9.1 carries 3 medium CVEs (XSS); no CSP present, amplifying XSS risk.
• Developer uses free Gmail address with no business domain — low accountability.
• 9 external JS hosts loaded (bootstrapmade, vimeo, youtube, etc.) with no CSP; MV3 but no content_security_policy set.

Evidence

• privacy_policy_generic store Policy URL points to Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true — not scoped to this extension.
• jquery_cve_bundle crx jquery@1.9.1 bundled with 3 moderate CVEs (CVE-2015-9251, CVE-2019-11358, CVE-2020-11023); fixed_in 3.5.0.
• no_csp crx content_security_policy is empty object; no CSP present on MV3 extension with vulnerable jQuery.
• external_hosts crx 9 external JS hosts: bootstrapmade.com, feross.org, getbootstrap.com, github.com, goo.gl, player.vimeo.com, popper.js.org, veno.es, youtube.com.
• free_webmail_developer store Developer email deepsidh912@gmail.com; no business domain; developer_domain_info=null.
• last_updated_missing store last_updated field is empty; months_since_update unknown — scored as >36 months for conservatism.
• description_mismatch store Description promises download functionality but 'downloads' permission is absent.
• rating_low store Rating 3.4 may indicate user dissatisfaction; install count 20,000.

CVE Exposures (3)

Permissions Breakdown

• desktopCapture high Can capture full screen, tabs, or windows — sensitive visual data capture capability.

Pillar Scores

Bookkeeping