Top Risks

• Privacy policy is generic Google account policy, not scoped to this extension, admits data collection and third-party sharing.
• NewTab override combined with description shell pattern flag raises monetization concern.
• Extension is 20 months stale — approaching abandoned-extension risk threshold.
• No CSP present (MV3 strict default mitigates but adds no explicit policy).
• No JS files scannable; surface area is minimal but unverifiable beyond manifest.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to empty_ntp.html — replaces new tab page, matches stated function.
• privacy_policy_generic store Policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• is_featured_by_google store Extension carries Google Featured badge, supporting legitimacy.
• developer_domain_chromium_org store Dev email thakis@chromium.org; chromium.org resolves and is a recognized project domain.
• maintenance_stale store Last updated October 2024, 20 months ago → 6.0 maintenance score (12-24mo band).
• shell_pattern_flag store description_promise.is_shell_pattern=true; however no permission mismatches detected.
• no_code_findings crx 0 JS files scanned, 0 code findings, obfuscation_score=0.0, no external hosts.
• threat_intel_clean api No bad_host_hits, no affiliate_hits, no monetization_hits, no operator siblings.

Permissions Breakdown

• chrome_url_overrides.newtab medium Replaces new tab page; medium risk per rubric but matches stated function.

Pillar Scores

Bookkeeping