Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Neymar New Tab Wallpaper [adware] (+2.0, capped).
• Uninstall URL hijack sends users to tabplugins.com on removal — classic monetization shell tactic.
• Install URL hijack opens tabplugins.com on install — unsolicited third-party redirect at install time.
• Privacy policy is Google's own policy (not scoped to this extension) — data practices completely undisclosed.
• NewTab override + search permission = persistent ad-monetization surface on every new browser tab.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://tabplugins.com/wallpaper/ (3rd-party redirect on uninstall)
• install_url_hijack crx onInstalled opens https://tabplugins.com/neymar-new-tab-wallpaper/ (3rd-party redirect on install)
• privacy_policy_generic store Policy URL is Google's account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true
• newtab_override manifest chrome_url_overrides.newtab → index.html; replaces every new tab with extension content
• developer_identity store Dev email waqasamjad1232@gmail.com (free webmail), no developer name, no verified publisher badge
• js_external_hosts crx Extension references 8 external hosts incl. tabplugins.com, chatgpt.com, x.com, instagram.com
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared
• maintenance_stale store 15 months since last update — falls in 12-24 month stale band (+6.0)
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Neymar New Tab Wallpaper [adware]; score 6.18 -> 8.18 (+2.0 cap 2.5).

Permissions Breakdown

• search medium Allows extension to influence search provider; paired with newtab override amplifies monetization risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; persistent ad/monetization surface on every new tab open.

Pillar Scores

Bookkeeping