Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sexy Tab [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override to sexytab.com intercepts all browser searches — persistent traffic monetization.
• Homepage and startup page both hijacked to sexytab.com with UTM tracking parameters.
• Privacy policy is Google's generic account policy — not scoped to this extension at all (+10.0).
• No developer name, email, or title — completely anonymous publisher with no accountability.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider sets sexytab.com as default search, is_default:true, with UTM params.
• homepage_override manifest chrome_settings_overrides.homepage and startup_pages both point to sexytab.com with campaign UTM tracking.
• privacy_policy_generic store Privacy policy URL is Google's own account policy (myaccount.google.com) — not scoped to this extension.
• privacy_policy_classification api fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.
• no_developer_identity store developer_name, developer_email, and title are all empty; verified_publisher=false, is_featured=false.
• no_update_date store months_since_update is null; maintenance score conservatively set to 6-12mo band (+3.5) as unknown.
• adult_domain_branding manifest Extension targets sexytab.com — adult-content domain as search/homepage provider raises brand and ToS concerns.
• no_csp manifest csp_present=false; MV3 strict-default applies so no +2.0 MV2 penalty, but no CSP declared in manifest.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sexy Tab [browser-hijack] + malext.io malicious_extension_sentry; score 6.27 -> 8.77 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.homepage high Overrides browser homepage to sexytab.com with UTM tracking — monetization redirect.
• chrome_settings_overrides.startup_pages high Forces startup page to sexytab.com — persistent traffic hijack on every browser launch.
• chrome_settings_overrides.search_provider high Sets sexytab.com as default search engine (is_default: true) — intercepts all user searches.

Pillar Scores

Bookkeeping