Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Fenerbahçe SK Anasayfa [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override with monetization-shape; privacy policy admits data collection + third-party sharing without extension-specific scoping.
• Privacy policy fetched but scope_extension==false + data_collection==true + third_party_sharing==true → D clause triggers maximum privacy score.
• Developer email on .vip TLD; not verified publisher, not featured; identity assurance low.
• Contacts m.instantsearch.net (ad/search intermediary) as external JS host — potential search monetization.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to startpage.html#newTab — controls every new tab for 20K users.
• privacy_policy_generic_with_sharing api Policy: scope_extension=false, data_collection=true, third_party_sharing=true — v3.5 clause D applies, score=10.
• external_host_instantsearch crx m.instantsearch.net in js_external_hosts; ad/search monetization intermediary.
• developer_vip_tld_no_verification store Developer email info@brandturbo.vip on elevated-risk TLD; not verified publisher, not Google-featured.
• react_very_old_version crx react@0.19.1 detected via license sidecar — extremely outdated but no CVEs in cve_findings_raw.
• no_csp manifest content_security_policy is null (MV3 strict default applies, no custom CSP — MV3 so no +2.0 penalty).
• fan_content_shell_pattern store Sports-team fan theme NewTab is classic fan-content/theme shell pattern (+1.5 webstore).
• no_bad_hosts_no_monetization_hits api threat_intel bad_host_hits=[], monetization_hits=[], affiliate_hits=[] — no direct threat-intel hits.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Fenerbahçe SK Anasayfa [browser-hijack] + malext.io malicious_extension_sentry; score 4.41 -> 6.91 (+2.5 cap 2.5).

Permissions Breakdown

• topSites medium Access to top visited sites list; used by NewTab pages for shortcuts but reveals browsing profile.
• favicon low Fetches favicons for display; low standalone risk.
• search medium Can query the default search engine; combined with newtab override raises monetization concern.
• chrome_url_overrides.newtab medium Replaces every new tab; prime surface for ad-monetization and search-redirect abuse.

Pillar Scores

Bookkeeping