Top Risks

• Privacy policy URL unreachable (domain does not resolve); extension is effectively operating without any disclosed privacy policy.
• Uninstall URL hijack and install URL hijack both flagged — classic monetization-shell behavior.
• NewTab override contacts external ad/analytics hosts: api.pgcollect.com, api.sendmepixel.com, feed.mambosearch.com.
• Extension is 37 months stale (zombie), dev domain does not resolve — no accountability path.
• No CSP declared; cookies permission plus external hosts with no content-script scope.

Evidence

• uninstall_and_install_url_hijack manifest Both uninstall_url_hijack and install_url_hijack are true — standard traffic-monetization shell pattern.
• external_ad_analytics_hosts crx JS contacts api.pgcollect.com, api.sendmepixel.com, feed.mambosearch.com — known analytics/ad-tech endpoints.
• developer_domain_dead api fashionnewtab.com does not resolve; privacy policy fetch failed with ConnectionError.
• privacy_policy_unfetchable api privacy_policy_classification.fetched==false due to ConnectionError; treated as no policy.
• newtab_override manifest chrome_url_overrides.newtab set to FashionTab.html; monetization surface for every new tab opened.
• zombie_extension store 37 months since last update; domain dead; no maintenance or accountability.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface==true; small install base with high-tier permissions (cookies + newtab override).

Permissions Breakdown

• cookies high Can read/write cookies; paired with host_permissions scoped to fashionnewtab.com but still high-risk capability.
• storage low Standard local storage; low standalone risk.
• chrome_url_overrides.newtab medium Replaces new-tab page; primary vector for ad/search monetization in this extension class.
• host_permissions: *://fashionnewtab.com/ low Scoped to own domain only; limits direct reach but domain no longer resolves.

Pillar Scores

Bookkeeping