Top Risks

• Uninstall URL hijack: chrome.runtime.setUninstallURL() to 3rd party
• Install URL hijack: onInstalled opens 3rd-party URL
• innerHTML DOM-XSS sink with no CSP set on the extension
• NewTab override with 'search' permission and link-out to many social hosts
• Privacy policy admits 3rd-party sharing, no retention disclosure

Evidence

• uninstall_url_hijack crx setUninstallURL hijack flagged true; traffic-monetization cluster pattern.
• install_url_hijack crx onInstalled opens 3rd-party URL; flagged true.
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; categorized NewTab with 'search' permission.
• dom_sink_no_csp crx innerHTML user-controlled sink in js/news.js and csp_present == false (FIX B -> +2.0).
• external_hosts crx JS references 7 hosts incl. chatgpt.com, instagram.com, x.com, youtube.com — broad for a wallpaper.
• privacy_policy store Fetched, extension-scoped, admits data collection + 3rd-party sharing; retention not disclosed.
• reputation store Unverified developer ExtNext; 875 installs; 5.0 rating with low rating count; no badges.
• cve_clean crx cve_findings_raw empty; jquery 3.7.1; no known-bad hosts; MV3.

Permissions Breakdown

• search medium Search API access pairs with newtab override; potential for search funnel control.
• chrome_url_overrides.newtab medium Replaces new tab page; monetization/shaping surface on every new tab.
• host_permissions:https://tabplugins.com/* low Narrow host scope limited to developer domain.

Pillar Scores

Bookkeeping