Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — beIN SPORTS Türkiye [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab override replaces every new tab; privacy policy admits data collection and 3rd-party sharing without scoping to this extension — triggers +10 privacy.
• Privacy policy fetched but scope_extension=false + data_collection=true + third_party_sharing=true: worst-case D clause (+10.0).
• Unverified developer (brandTURBO / .vip domain) presenting extension as official beIN SPORTS app with only 60 installs.
• topSites + search + newtab override combination creates user-profiling surface despite no broad host_permissions.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = startpage.html#newTab; replaces every new tab page.
• privacy_policy_d_clause crx Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true → D-clause +10 privacy.
• unverified_developer store verified_publisher=false, is_featured=false; .vip TLD domain, claims to be official beIN SPORTS app.
• instantsearch_host crx m.instantsearch.net in js_external_hosts; known search-monetization CDN used by NewTab shells.
• no_csp manifest content_security_policy=null; MV3 has strict default but no explicit CSP declared.
• topsites_permission manifest topSites permission combined with NewTab override enables user browsing profiling.
• low_installs_newtab store Only 60 installs; NewTab override with search integration at very early stage.
• no_cve_findings crx cve_findings_raw empty; react@0.19.1 detected but no CVE matched by scanner.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — beIN SPORTS Türkiye [browser-hijack] + malext.io malicious_extension_sentry; score 4.07 -> 6.57 (+2.5 cap 2.5).

Permissions Breakdown

• topSites medium Reads user's most visited sites; combined with NewTab override creates profiling surface.
• favicon low Reads site favicons; low standalone risk.
• search medium Can interact with browser search; elevated in NewTab context.
• chrome_url_overrides.newtab medium Replaces every new tab with extension page; high-reach monetization surface.

Pillar Scores

Bookkeeping