Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Debterminator [adware] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab page; prime monetization/redirect surface.
• Privacy policy is Google's generic policy — does not scope data handling to this extension.
• Developer email is free-webmail (Proton) with no verified business identity.
• Extension is 20 months stale with no install count signal — maintenance risk.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = override_page.html; replaces every new tab for all users.
• privacy_policy_generic store Policy URL is Google's own account privacy page — scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_email_free_webmail store gameoftoday@proton.me — free webmail, no verified business domain.
• stale_extension store Last updated January 2025; 20 months since update — maintenance risk band 6-12mo threshold.
• no_install_count store Install count not available; reach unknown.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false.
• no_bad_hosts_no_cve crx cve_findings_raw and bad_host_hits both empty; code_findings_raw empty; obfuscation_score=0.0.
• no_external_js_hosts crx js_external_hosts=[]; no outbound network surface detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Debterminator [adware] [divergent] + malext.io malicious_extension_sentry; score 4.93 -> 7.43 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local extension data; no cross-origin or user-data exfil risk alone.
• chrome_url_overrides.newtab medium Replaces every new tab; high-visibility real estate, monetization/redirect risk.

Pillar Scores

Bookkeeping