Top Risks

• NewTab override with install/uninstall URL hijacking
• Privacy policy admits data collection and 3rd-party sharing
• DOM-XSS sink (innerHTML) present without CSP
• Anonymous developer identity despite branded domain
• Fictional anime branding used to distribute utility software

Evidence

• newtab_override manifest Extension overrides chrome_url_overrides.newtab with custom newtab.html
• install_uninstall_hijack crx Extension sets both install and uninstall URLs (hijack flags true)
• privacy_policy_classification api Policy fetched but admits data collection and 3rd-party sharing without retention details
• developer_identity store Developer name is empty; only email info@tabplugins.com provided
• dom_xss_sink crx dom_sink_innerhtml_userctrl found in js/news.js with no CSP present
• category_shape manifest Anime-branded wallpaper extension functions as NewTab/search utility
• external_js_hosts crx Extension references external hosts including chatgpt.com, instagram.com, youtube.com
• threat_intel_clean api No bad hosts, monetization hits, or operator cluster siblings detected

Permissions Breakdown

• search medium Allows modification of search settings, typically paired with newtab override.
• chrome_url_overrides.newtab medium Overrides the default new tab page, allowing content injection on every new tab.
• host_permissions:https://tabplugins.com/* low Scoped to developer's own domain, limited cross-site risk.

Pillar Scores

Bookkeeping