Top Risks

• Uninstall URL hijack to crazycraftz.com — classic traffic-monetization shell pattern
• Privacy policy is a generic Google account URL that failed to fetch; no extension-scoped policy exists
• NewTab override with 12 external JS hosts including social/ad-adjacent domains (Pinterest, Facebook, Twitter)
• Bundled jquery@1.9.1 carries 3 moderate XSS CVEs (CVE-2019-11358, CVE-2020-11023, CVE-2015-9251), no CSP present
• No developer identity (name/email blank), no install/rating data, manifest uses localized placeholders — minimal accountability

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://crazycraftz.com/uninstall/?utm_campaign=ext&utm_medium=uninstall&utm_source=cool; Webstore +3.0
• install_url_hijack crx onInstalled URL hijack flagged; Webstore +2.0
• newtab_override manifest chrome_url_overrides.newtab = Minecraft_8659alaindex.html; replaces every new tab page
• privacy_policy_unfetchable crx Policy URL is generic Google account page; fetch failed SSLError; classified fetched=false → Privacy +10.0
• jquery_cve crx jquery@1.9.1 bundled; 3 moderate CVEs (XSS); fixed_in 3.5.0; no CSP — CVE pillar 4.5 after ×1.5 amplifier
• no_developer_identity store developer_name and developer_email both empty; no verified_publisher; no featured badge → Reputation elevated
• external_js_hosts crx 12 distinct external JS hosts including pinterest.com, facebook.com, twitter.com, crazycraftz.com; >3 domains → Network +1.5
• no_csp manifest content_security_policy null; csp_present=false; amplifies CVE XSS risk and adds Code Quality +2.0 (jquery<3.5+no CSP)

CVE Exposures (3)

Permissions Breakdown

• topSites medium Reads user's most visited sites; meaningful privacy exposure for a NewTab extension.
• unlimitedStorage low Allows large local data storage; low standalone risk.
• storage low Standard key-value storage; low risk.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; high reach, monetization surface.

Pillar Scores

Bookkeeping