Top Risks

• NewTab override combined with 'search' permission enables full search hijack and ad-monetization on every new tab.
• Uninstall URL hijack and install URL hijack: aggressive lifecycle tracking by free-webmail developer.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension (v3.5-D trigger: +10 privacy).
• Developer is unverified free-webmail (kthill8080@gmail.com) with no business identity; reputation floor at 7.5.
• 24-month stale maintenance combined with 1-star rating signals abandoned or low-quality extension with 10K install blast radius.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set; every new tab replaced. +2.0 webstore (newtab override with monetization shape).
• uninstall_and_install_url_hijack crx Both uninstall_url_hijack and install_url_hijack true; +3.0 and +2.0 webstore lifecycle hijack signals.
• free_webmail_developer store Developer email kthill8080@gmail.com; no verified publisher; no business domain. Reputation floor 7.5.
• privacy_policy_scope_fail api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true. v3.5-D: +10.0 privacy.
• low_rating store Rating 1.0 (minimum possible); 10K installs with 1-star signals user-reported harm.
• stale_maintenance store months_since_update=24; maintenance pillar +6.0 (12-24mo band).
• dom_xss_sink crx innerHTML user-controlled sink in chunk JS; CSP present but no eval protection confirmed for this path.
• connect_src_bing_geoip manifest CSP connect-src includes bing.com, r.bing.com, geoip-js.com; geo-fingerprinting + search routing to Bing.

Permissions Breakdown

• search medium Can intercept and redirect search queries; combined with NewTab override amplifies search hijack risk.
• storage low Local data persistence; low standalone risk.
• chrome_url_overrides.newtab medium Replaces every new tab page; high-reach surface for ad monetization and search redirect.

Pillar Scores

Bookkeeping