Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Beşiktaş JK Anasayfa [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy admits data collection and third-party sharing without scoping to this extension — Privacy pillar maxed at 10.0.
• NewTab override replaces every new-tab page; combined with 'search' permission creates search monetization surface.
• Unverified developer (brandTURBO / .vip domain) with no Google verification badge.
• react@0.19.1 is extremely old (2015); no CVEs found but well past end-of-life.

Evidence

• privacy_policy_generic_admits_sharing api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true → v3.5(D) +10.0 privacy.
• newtab_override manifest chrome_url_overrides.newtab = startpage.html#newTab; replaces every new-tab page.
• search_permission manifest search permission declared alongside newtab override; enables search-engine monetization.
• external_host_instantsearch crx m.instantsearch.net in js_external_hosts — ad/search monetization endpoint.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; .vip TLD domain, no recognized org.
• old_react_library crx react@0.19.1 (2015) detected via license sidecar; no CVEs flagged but severely outdated.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit hardening.
• domain_established api brandturbo.vip first cert 2020-02-27, age_days=2379, resolves=true; not a throwaway domain.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Beşiktaş JK Anasayfa [browser-hijack] + malext.io malicious_extension_sentry; score 4.28 -> 6.78 (+2.5 cap 2.5).

Permissions Breakdown

• topSites medium Reads user's most visited sites; mild privacy concern for a NewTab extension.
• favicon low Fetches favicons for display; low standalone risk.
• search medium Can set/read default search engine; elevated for NewTab monetization context.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary delivery mechanism for search monetization.

Pillar Scores

Bookkeeping