Top Risks

• Uninstall and install URL hijack flags both true — traffic-monetization shell fingerprint.
• NewTab + 'search' permission on a football-wallpaper shell; search monetization risk.
• No developer name, unverified publisher, no business website beyond tabplugins.com.
• No CSP with innerHTML DOM-sink in news.js (mitigated by MV3 default CSP).
• Privacy policy admits data collection and third-party sharing, no retention stated.

Evidence

• install_url_hijack crx onInstalled opens third-party URL flag set; target URL not captured.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() to third party per listing flags.
• newtab_override crx chrome_url_overrides.newtab=newtab.html; scored on permissions pillar per v2 (a).
• search_permission crx 'search' permission grants search-provider control on a wallpaper extension.
• no_csp crx csp_present=false, MV3; innerHTML sink in news.js present but no CVEs and no eval.
• privacy_policy api Scoped, admits data collection + third-party sharing, retention not disclosed.
• reputation store No dev name, not verified, not featured; 999 installs; rating 5 with unknown count.
• cve_clean crx cve_findings_raw empty; jquery 3.7.1; no known-bad-host hits.

Permissions Breakdown

• search medium Search-provider control; on a NewTab wallpaper shell this is a monetization vector.
• chrome_url_overrides.newtab medium Overrides every new tab page; classic ad/redirect monetization shape.

Pillar Scores

Bookkeeping