Top Risks

• Uninstall URL hijack: setUninstallURL to third-party destination.
• Install URL hijack: onInstalled opens third-party URL.
• External JS hosts include social platforms (instagram.com, x.com, youtube.com).
• DOM-XSS sink (innerHTML on variable) in js/news.js.
• Unverified publisher with low install base (1,000).

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; +3.0 webstore per low-effort monetization cluster.
• install_url_hijack crx install_url_hijack=true; +2.0 webstore per low-effort monetization cluster.
• newtab_override manifest chrome_url_overrides.newtab=newtab.html; matches stated wallpaper function, no monetization shape proven.
• code_finding crx dom_sink_innerhtml_userctrl in js/news.js; CSP absent but no eval/CVE combo: +0.5.
• external_hosts crx js_external_hosts: chatgpt.com, instagram.com, x.com, youtube.com, google.com, tabplugins.com.
• privacy_policy api Fetched, scoped to extension, data_collection=true, retention=false, 3rd-party sharing disclosed: +1.0.
• threat_intel api No bad-host/monetization/affiliate hits; tabplugins.com resolves, 532 days old, 28 certs.
• reputation store Unverified publisher, not featured; dev email on own business domain; rating 5.0, installs 1,000.

Permissions Breakdown

• search medium Search settings access; med impact, no provider override declared in settings.
• chrome_url_overrides.newtab medium Replaces new tab page; consistent with stated wallpaper function.
• host_permissions: https://tabplugins.com/* low Narrow host access scoped to developer's own domain.

Pillar Scores

Bookkeeping