Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• Two plain-HTTP host permissions on mavo-dash.com non-standard ports (8080/2052) expose unencrypted traffic to unknown third party.
• New-tab override replaces every new-tab page for 40K users; high reach for any future compromise.
• eval() on user-controlled variable in bundled JS; combined with new Function() pattern raises code execution risk.
• Uninstall URL hijack detected; destination unknown — potential post-removal tracking.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own account policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• mavo_dash_plain_http manifest host_permissions include http://mavo-dash.com:8080/* and http://mavo-dash.com:2052/*; unencrypted, unknown third party.
• eval_user_input crx static/js/5.ba58cbb8.chunk.js: eval(code) called inside regenerateByEval method — direct eval of variable.
• uninstall_url_hijack crx install_url_hijack=true and uninstall_url_hijack=true; target URL null (not resolved); post-uninstall redirect risk.
• affiliate_bit_ly crx bit.ly in js_external_hosts and affiliate_hits; generic short-link redirector used for affiliate/cloaking.
• newtab_override manifest chrome_url_overrides.newtab=index.html replaces every new-tab page; high reach across 40K installs.
• google_analytics_telemetry manifest Host permission *://*.google-analytics.com/* and monetization_hits confirm telemetry sent to GA.
• verified_featured store verified_publisher=true and is_featured_by_google=true; partially mitigates reputation risk.

Permissions Breakdown

• favicon low Read favicon URLs; low sensitivity on its own.
• chrome_url_overrides.newtab high Replaces every new-tab page; highest-reach surface for a NewTab extension.
• host: *://new-tab.studio/* low Developer's own domain; scoped to their API.
• host: *://api.openweathermap.org/* low Weather API; narrow third-party scope.
• host: *://*.google-analytics.com/* medium Telemetry host; user activity sent to Google Analytics.
• host: *://*.unsplash.com/* low Image CDN; no credential risk.
• host: *://*.giphy.com/* low GIF CDN; no credential risk.
• host: http://mavo-dash.com:8080/* high Plain HTTP on non-standard port; unknown third-party; traffic unencrypted.
• host: http://mavo-dash.com:2052/* high Plain HTTP on non-standard port; same unknown third-party; traffic unencrypted.

Pillar Scores

Bookkeeping