Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Top Best Extension + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns fetch error — treated as no policy; data handling entirely undisclosed.
• NewTab override + uninstall URL hijack is a classic ad-monetization shell pattern.
• No developer name listed; bidwise.com domain is an ad-tech domain, suggesting monetization intent.
• DOM-XSS sink (innerHTML) with no CSP elevates code quality risk on a NewTab page seen by every tab open.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — controls every new tab page.
• uninstall_url_hijack crx uninstall_url_hijack=true; classic monetization/tracking signal on uninstall.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false (HTTPError); scored as no policy (+10.0 privacy).
• developer_domain_adtech store Developer email topbest@bidwise.com; bidwise.com is an ad-tech/bidding platform domain.
• no_developer_name store developer_name is empty string; identity unverifiable beyond email domain.
• dom_xss_sink_no_csp crx innerHTML user-controlled sink in 481.js with csp_present=false; elevated XSS risk.
• monetization_hit_analytics crx www.google-analytics.com in js_external_hosts; telemetry-tier monetization hit.
• verified_publisher store verified_publisher=true but monetization signals present; v3.5(E) caps discount at -1.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Top Best Extension + malext.io malicious_extension_sentry; score 5.44 -> 7.94 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data persistence, low risk.
• unlimitedStorage low Allows large local storage, low direct harm.
• search medium Can interact with browser search; combined with newtab override raises concern.
• webNavigation medium Observes all navigation events; tracking/redirect risk.
• chrome_url_overrides.newtab high Replaces every new tab — prime monetization surface, ad injection vector.

Pillar Scores

Bookkeeping