Top Risks

• NewTab override replaces every new tab with developer-controlled content enabling persistent tracking and search monetization.
• Uninstall and install URL hijack signals active user-journey interception on extension lifecycle events.
• Privacy policy admits data collection and third-party sharing without data retention disclosure.
• Extension contacts 7 external JS hosts (YouTube, Instagram, X, ChatGPT, etc.) with no CSP restricting script execution.
• No verified publisher badge; 'search' permission combined with NewTab override is a known ad-monetization pattern.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — hijacks every new tab page for 3,000 users.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but signal confirms lifecycle URL interception code present.
• install_url_hijack crx install_url_hijack=true; opens URL on install, classic engagement/monetization pattern.
• js_external_hosts crx 7 external hosts referenced: chatgpt.com, instagram.com, youtube.com, x.com, chrome.google.com, google.com, tabplugins.com.
• no_csp manifest content_security_policy is null; no script-src restrictions despite MV3 (default MV3 CSP applies but no explicit hardening).
• privacy_policy_third_party_sharing api Policy fetched, scoped, admits data collection and third-party sharing; retention not disclosed.
• no_verified_publisher store Developer 'AllFandom' / info@tabplugins.com has no verified publisher badge and is not a recognized org.
• search_permission_newtab manifest 'search' permission + newtab override with no host_permissions is a standard ad-monetization NewTab shell fingerprint.

Permissions Breakdown

• search medium Allows reading/intercepting search queries; high value for monetization in NewTab context.
• chrome_url_overrides.newtab medium Replaces every new tab; primary delivery mechanism for ad/affiliate monetization and tracking.

Pillar Scores

Bookkeeping