Top Risks

• Uninstall URL hijack flag indicates traffic-monetization shell pattern
• Install URL hijack flag: onInstalled opens third-party URL
• NewTab override extension with wallpaper theme = low-effort monetization shape
• No CSP declared on MV3 (no penalty but noted); external hosts include social/AI sites
• Privacy policy admits data collection, no retention disclosure

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; setUninstallURL pattern flagged
• install_url_hijack crx install_url_hijack=true; onInstalled opens third-party URL
• newtab_override manifest chrome_url_overrides.newtab = newtab.html; wallpaper NewTab category
• permissions manifest permissions=[search]; no host_permissions or content_scripts
• privacy_policy api fetched, scoped, data_collection=true, retention=false, 3rd-party sharing
• reputation store No verified publisher, no featured badge; dev email info@tabplugins.com
• maintenance store Updated June 2026, ~4 months ago; 677 installs
• cve_code crx jquery 3.7.1 (current), no CVEs, no code findings, obfuscation 0.0

Permissions Breakdown

• search low Search API access; no provider override declared
• chrome_url_overrides.newtab medium Overrides new tab page, classic monetization shape

Pillar Scores

Bookkeeping