Top Risks

• Privacy policy fetched but scope_extension=false AND data_collection+third_party_sharing=true: policy admits data collection/sharing without scoping to this extension.
• NewTab override by gmail-dev with no verified publisher: replaces every new tab for 40K users with no accountability.
• Geolocation + bigdatacloud.net enables precise location profiling on every new tab open.
• 12 external JS hosts including giphy.com, instagram.com, github.com, discord.gg, buymeacoffee.com — broad network surface with no CSP.
• Free-webmail developer (gmail), no verified publisher badge, privacy policy hosted on free GitHub Pages without extension-specific scope.

Evidence

• newtab_override manifest chrome_url_overrides.newtab = newtab.html; replaces every new tab for all 40K users.
• privacy_policy_scope_mismatch crx Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true: v3.5(D) triggers +10.0.
• geolocation_permission manifest Geolocation declared alongside bigdatacloud.net host permission; location profiling on each newtab open.
• free_webmail_dev store developer_email=emily.xietty@gmail.com; no verified publisher; no business domain.
• broad_external_hosts crx 12 external JS hosts (giphy, instagram, discord, github, buymeacoffee, etc.) with no CSP present.
• no_csp manifest content_security_policy is null; MV3 enforces strict default but 12 external hosts still reachable.
• geo_diversity api JS hosts span 4 countries (CA, DE, IN, US); v3.3 rule 14 applies: +1.5 network.
• featured_by_google store is_featured_by_google=true provides partial reputation credit (-2.0 reputation).

Permissions Breakdown

• storage low Stores local extension state; low abuse potential alone.
• bookmarks medium Can read full bookmark tree; exposes browsing history indirectly.
• search medium Can query search terms; combined with newtab override raises monetization risk.
• favicon low Reads site favicons; minimal privacy impact.
• geolocation medium Accesses precise location; unusual for a NewTab extension.
• chrome_url_overrides.newtab medium Replaces every new-tab page; high reach, monetization surface.
• host: api.open-meteo.com low Weather API; matches newtab weather widget use-case.
• host: api.bigdatacloud.net medium Geo-IP lookup service; combined with geolocation permission creates location-profiling surface.

Pillar Scores

Bookkeeping