Top Risks

• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension (generic corporate policy).
• NewTab override with 300K installs — high-engagement surface for potential monetization or data capture.
• declarativeNetRequestWithHostAccess can intercept/modify network requests; elevated capability for a tab manager.
• tabs permission exposes URLs/titles of all open tabs; combined with analytics endpoints (Amplitude, Mixpanel) raises tracking concern.
• Three innerHTML DOM-XSS sinks in content scripts and background; CSP style-src uses 'unsafe-inline' and wildcard.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = toby.html; replaces new-tab page for all 300K users.
• privacy_policy_scope_mismatch api Policy fetched; data_collection=true, third_party_sharing=true, scope_extension=false — generic policy, not extension-scoped.
• analytics_endpoints crx JS contacts api.amplitude.com and api.mixpanel.com; telemetry sent alongside tabs metadata.
• dom_xss_sinks crx 3 innerHTML assignments from variables found in background.js, Note chunk, and content-script inject-public.js.
• csp_style_wildcard_unsafe_inline manifest style-src includes 'unsafe-inline' and '*'; weakens CSP protections against style injection.
• declarativeNetRequestWithHostAccess manifest High-capability permission to intercept requests; only scoped to *.gettoby.com but still elevated.
• featured_by_google store Extension is featured by Google — partial trust signal; no verified publisher badge.
• no_developer_name store developer_name is empty string; only email hello@gettoby.com available.

Permissions Breakdown

• contextMenus low Adds right-click menu items; limited surface.
• unlimitedStorage low Allows large local data storage; no exfil risk alone.
• storage low Standard sync/local storage; expected for tab manager.
• tabs medium Can read tab URLs/titles across all tabs — broad metadata access.
• declarativeNetRequestWithHostAccess high Can intercept/block network requests; paired with host permissions.
• chrome_url_overrides.newtab medium Replaces new-tab page; high-engagement surface, monetization risk.
• host_permissions: https://*.gettoby.com/ low Scoped to developer's own domain; low third-party risk.

Pillar Scores

Scoring History

Bookkeeping