Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Content script injected on <all_urls> with newtab override; high reach across every browsing session.
• No developer identity (name/email/domain) — zero accountability if extension is sold or compromised.
• new Function() constructor in background.js and content.js enables dynamic code execution patterns.
• External JS host meme-api.com contacted without CSP; unverified third-party endpoint with no policy coverage.

Evidence

• generic_google_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy (v3.5 rule D).
• no_developer_identity store developer_name, developer_email, and developer_domain all empty; no accountability signal.
• newtab_override manifest chrome_url_overrides.newtab present; replaces every new tab with extension-controlled page.
• content_script_all_urls manifest content_scripts_matches=[<all_urls>] combined with host_permissions=[<all_urls>]; maximum reach.
• function_constructor_x2 crx new Function() found in background.js and content.js; dynamic code execution capability present.
• external_js_host crx meme-api.com listed in js_external_hosts; no CSP restricting connections; unverified third-party.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src.
• maintenance_unknown store months_since_update is null and last_updated is null; scored conservatively at 6-12mo band (+3.5).

Permissions Breakdown

• storage low Stores local extension state; limited risk on its own.
• tabs medium Can read tab URLs and titles across all tabs; moderate privacy exposure.
• declarativeNetRequest medium Can block/redirect network requests; lower risk than webRequest but still significant.
• <all_urls> (host_permissions) high Broad host access enabling content scripts and network requests on every site.
• newtab (chrome_url_overrides) medium Replaces new tab page; controls user's default landing page, monetization vector.
• <all_urls> (content_scripts_matches) high Content script injected on every page; can read/modify all page content.

Pillar Scores

Bookkeeping