Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Symbaloo Homepage [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy fetched but not scoped to this extension; admits data collection and third-party sharing (v3.5-D: +10.0 privacy).
• Extension is 21 months stale — governance and security posture uncertain.
• No developer name listed; reduces accountability.
• Homepage and startup-page override forces all traffic through symbaloo.com on every browser open.

Evidence

• privacy_policy_generic_collecting api Policy fetched, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5-D).
• chrome_settings_overrides manifest homepage and startup_pages overridden to https://www.symbaloo.com; scored as medium permissions.
• maintenance_stale store Last updated Nov 2024; months_since_update=21 → 6-12mo band +3.5, but 21mo pushes into 12-24mo +6.0.
• no_developer_name store developer_name is empty string; reputation starts at 5.0 +1.0 for missing dev name.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust discounts apply.
• no_code_surface crx js_file_count=0, code_findings_raw=[], obfuscation_score=0.0 — no JS to analyze; code quality=0.
• no_bad_hosts_no_monetization api bad_host_hits=[], monetization_hits=[], affiliate_hits=[] — no threat-intel hits.
• cve_none api cve_findings_raw=[] — no CVE exposure.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Symbaloo Homepage [browser-hijack] + malext.io malicious_extension_sentry; score 4.21 -> 6.71 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.homepage medium Overrides user homepage to symbaloo.com; medium impact, monetization-adjacent.
• chrome_settings_overrides.startup_pages medium Overrides startup pages to symbaloo.com; forces navigation on browser open.

Pillar Scores

Bookkeeping