Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Merry Christmas New Tab & Snow Theme [browser-hijack] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic account policy — not scoped to this extension and admits data collection + third-party sharing.
• Developer uses free Gmail address with no verified business identity or domain.
• last_updated missing: maintenance posture unknown; could be abandoned.
• NewTab override controls every new tab; future update could introduce redirect or ad monetization.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — scores +10.0 Privacy (v3.5 rule D).
• free_webmail_developer store Developer email rs9115568@gmail.com is free webmail; no business domain resolvable (domain_age_ct skipped).
• newtab_override manifest chrome_url_overrides.newtab replaces all new tab pages; search_engine_count=1 (google only), no redirect anomaly.
• maintenance_unknown store last_updated empty and months_since_update null; scored conservatively at 6-12mo band (+3.5) capped at 6.0.
• featured_not_verified store is_featured_by_google=true but verified_publisher=false; featured discount applied to Reputation (-2.0).
• no_code_risks crx code_findings_raw empty, obfuscation_score=0.0, js_external_hosts limited to suggestqueries.google.com.
• no_cve_no_bad_hosts crx cve_findings_raw empty, bad_host_hits empty, monetization_hits empty, affiliate_hits empty.
• low_install_count store Only 142 installs; install_perm_anomaly flags false; small reach limits blast radius.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Merry Christmas New Tab & Snow Theme [browser-hijack] [divergent] + malext.io malicious_extension_sentry; score 4.52 -> 7.02 (+2.5 cap 2.5).

Permissions Breakdown

• search low Allows querying search suggestions; scoped to suggestqueries.google.com, fits NewTab function.
• newtab override (chrome_url_overrides) medium Replaces every new tab page; primary NewTab capability, moderate risk for monetization/redirect.
• https://suggestqueries.google.com/ (host_permission) low Narrow Google endpoint for autocomplete; no broad host access.

Pillar Scores

Bookkeeping