Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — West Bromwich Albion FC [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — triggers maximum privacy score.
• NewTab override with m.instantsearch.net contact is a classic monetization/search-hijack vector.
• No developer name listed; brandturbo.vip is an unverifiable brand-factory domain running many themed extensions.
• Privacy policy scope_extension=false with data_collection=true and third_party_sharing=true (D rule: +10.0).

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to startpage.html#newTab; replaces every new tab.
• privacy_policy_generic_with_sharing api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — rule D applies: +10.0.
• instantsearch_net_contact crx m.instantsearch.net in js_external_hosts — known NewTab ad/search monetization endpoint.
• no_developer_name store developer_name is empty; accountability gap per rubric (+1.0 reputation).
• brandturbo_vip_domain store brandturbo.vip hosts many themed sports/fan NewTab extensions; brand-factory pattern.
• react_version_old crx react@0.19.1 detected (license sidecar); very old but no CVEs in cve_findings_raw.
• csp_absent_mv3 manifest content_security_policy is null; MV3 has strict default so no network penalty added.
• operator_cluster_no_siblings api sibling_count=0; no operator cluster amplifier applies.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — West Bromwich Albion FC [browser-hijack] + malext.io malicious_extension_sentry; score 4.29 -> 6.79 (+2.5 cap 2.5).

Permissions Breakdown

• topSites medium Accesses user's most visited sites; relevant for NewTab but privacy-sensitive.
• favicon low Reads favicons for display; low standalone risk.
• search medium Can interact with browser search; relevant to NewTab monetization surface.
• chrome_url_overrides.newtab medium Replaces new-tab page; core monetization vector for this category.

Pillar Scores

Bookkeeping