Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — 迷鹿起始页 [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab + homepage override points to go.mintab.cn — persistent traffic capture on every new tab.
• Privacy policy is Google's generic account policy (scope_extension=false, admits 3rd-party sharing) → scored +10.
• Extension last updated 28 months ago; stale with no changelog.
• Developer is anonymous (no name, free-webmail Gmail, no business site), reducing accountability.

Evidence

• newtab_override manifest chrome_url_overrides.newtab=newtab.html; homepage overridden to https://go.mintab.cn/
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• stale_extension store Last updated April 2024; 28 months since update — maintenance score 8.5.
• anonymous_developer store developer_name empty; email yuyehipi@gmail.com (free webmail, no business domain).
• verified_publisher store verified_publisher=true but discount capped: generic policy admits data_collection+third_party_sharing.
• js_external_host crx go.mintab.cn is the sole external JS host; CN-geolocated only.
• no_cve_no_code_findings crx cve_findings_raw empty; code_findings_raw empty; obfuscation_score 0.0.
• low_install_count store Only 105 installs; no blast-radius concern but also no community vetting.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — 迷鹿起始页 [browser-hijack] + malext.io malicious_extension_sentry; score 5.42 -> 7.92 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local extension settings; no cross-origin risk.
• chrome_url_overrides.newtab medium Replaces every new-tab page; significant reach and monetization potential.
• chrome_settings_overrides.homepage medium Redirects homepage to go.mintab.cn; persistent browser-level override.
• content_scripts on *.mintab.cn low Scoped to own domain only; limited cross-site exposure.

Pillar Scores

Bookkeeping