Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry (+2.5, capped).
• Critical CVE-2021-23358 (ACE) in bundled underscore@1.8.3 across 400K installs; unfixed.
• NewTab override contacting 4 search engines (baidu/bing/google/yahoo) — ad-monetization aggregator pattern.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension.
• Multiple new Function() dynamic code execution paths and DOM-XSS innerHTML sinks in extension JS.

Evidence

• critical_cve_bundled_lib crx underscore@1.8.3 carries CVE-2021-23358 (critical ACE) and CVE-2026-27601 (high DoS); fixed_in 1.13.8 not applied.
• newtab_override_4_search_engines manifest chrome_url_overrides.newtab set; threat_intel shows 4 search engines (baidu, bing, google, yahoo) — ad-monetization aggregator pattern.
• privacy_policy_not_extension_scoped api Policy fetched but scope_extension==false, data_collection==true, third_party_sharing==true → v3.5 rule D: +10.0 privacy.
• free_webmail_dev_no_name store developer_email=infinitynewtab@gmail.com; developer_name empty; no verified business identity.
• function_constructor_and_innerhtml crx Multiple new Function() uses including Vue template compiler and debugger tracer; 4 innerHTML-from-variable DOM-XSS sinks.
• verified_publisher store verified_publisher==true but cve_findings_raw non-empty → invariant 0c caps discount at -1.0.
• multi_search_engine_newtab api NewTab category + search_engine_count==4 → +2.5 webstore (v3.5 rule C).
• 12_external_js_hosts crx 12 distinct external hosts across baidu, bing, yahoo, google subdomains plus infinitynewtab.com own domain.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — DarkSpectre ShadyPanda expansion / Zoom Stealer (name unconfirmed) [click-fraud] + malext.io malicious_extension_sentry; score 4.86 -> 7.36 (+2.5 cap 2.5).

CVE Exposures (2)

Permissions Breakdown

• activeTab low Access to current tab on user gesture only; limited blast radius.
• storage low Local data persistence; standard for NewTab extensions.
• unlimitedStorage low Allows large local storage; minor abuse risk for caching exfil data.
• offscreen low Offscreen document support; elevated risk only if combined with exfil signals.
• background low Persistent background context; standard for NewTab but increases dwell time.
• search medium Can issue search queries programmatically; relevant for search-redirect abuse.
• chrome_url_overrides.newtab medium Replaces every new tab with extension UI; high reach and monetization surface.

Pillar Scores

Operator Siblings (1)

Other extensions sharing this developer's compound fingerprint:

• nnnkddnnlpamobajfibfdgfnbcnkgngh

Bookkeeping