Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — QweTab [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override + content_scripts on <all_urls> including all major search engines enables search hijack and page manipulation.
• Privacy policy URL returned fetch error — policy effectively unavailable; data practices unknown.
• Uninstall and install URL hijack flags present; typical monetization shell behavior.
• Suspicious external host packagestrack.com and www-bestfreemaps-com.s1search.co in JS; non-obvious third-party reach.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to /dist/index.html; replaces every new tab with extension UI.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls> plus explicit google/bing domains — full-page read/write.
• uninstall_install_url_hijack crx Both uninstall_url_hijack and install_url_hijack flagged true; common monetization shell pattern.
• privacy_policy_fetch_error api privacy_policy_classification.fetched==false, reason fetch_error:HTTPError; policy inaccessible.
• suspicious_external_hosts crx JS contacts packagestrack.com and www-bestfreemaps-com.s1search.co; unrelated to stated PDF/tab function.
• dom_sink_no_csp crx innerHTML user-controlled sink in dist/js/826.js with csp_present==false; elevated XSS risk.
• function_constructor crx new Function() usage in dist/js/706.js; dynamic code execution vector.
• no_verified_publisher store verified_publisher==false, is_featured_by_google==false; no accountability signals.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — QweTab [browser-hijack] + malext.io malicious_extension_sentry; score 6.01 -> 8.51 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data storage; low standalone risk.
• search medium Can interact with browser search; relevant for NewTab search monetization.
• host_permissions: https://*.qwerpdf.com/ low Scoped to developer's own domain only.
• content_scripts: <all_urls> high Content scripts injected on all URLs; broad read/write access to every page visited.
• content_scripts: multiple google/bing domains medium Explicit injection into major search engines suggests search result manipulation.
• chrome_url_overrides: newtab medium Replaces new-tab page; core monetization surface for NewTab extensions.

Pillar Scores

Bookkeeping