Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — NewJeans Wallpaper [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• 9 unfixed medium-severity CVEs across three bundled jQuery/jQuery-UI versions (1.9.1, 3.4.1, 1.12.1), all below fixed_in thresholds.
• Privacy policy is Google's generic account policy — not scoped to this extension, yet admits data collection and third-party sharing (v3.5-D → +10.0).
• NewTab override with free-webmail Gmail developer, no verified publisher, and no business domain — classic monetization-shell risk surface.
• No CSP declared (MV3 but null CSP) combined with vulnerable jQuery libraries increases XSS exploitation risk in the new-tab context.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to Hav35DinO12index.html — controls every new tab for the user.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• cve_bundled_libs crx jquery-ui@1.12.1 (4 CVEs), jquery@3.4.1 (2 CVEs), jquery@1.9.1 (3 CVEs) — all moderate, none at fixed_in version.
• free_webmail_dev store Developer email maya.goh1987@gmail.com; no business site; no verified publisher badge → reputation floor 7.5.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening despite vulnerable jQuery libraries.
• js_external_hosts crx 12 external JS hosts referenced including coolthemestores.com, social platforms, CDNs — broad third-party surface.
• maintenance_stale store 16 months since last update; vulnerable libraries unfixed; stale extension with newtab capability.
• topSites_permission manifest topSites permission reads user's most-visited URLs — privacy-sensitive for a wallpaper extension with unscoped privacy policy.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — NewJeans Wallpaper [adware] + malext.io malicious_extension_sentry; score 5.48 -> 7.98 (+2.5 cap 2.5).

CVE Exposures (9)

Permissions Breakdown

• topSites medium Reads user's most visited sites; privacy-sensitive for a wallpaper/NewTab extension.
• unlimitedStorage low Allows storing large data locally; low direct harm but enables caching abuse.
• storage low Standard extension storage; low risk on its own.
• search medium Can programmatically invoke search; combined with newtab override raises concern.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization/redirect surface for every new tab opened.

Pillar Scores

Bookkeeping