Top Risks

• Uninstall URL hijack routes through Google redirect to tabplugins.com — traffic harvesting signal.
• Install URL hijack opens tabplugins.com on install with UTM tracking.
• scripting + *://*/* allows arbitrary JS injection across all sites.
• Privacy policy admits third-party sharing with no retention period disclosed.
• Only 47 installs with HIGH-tier permissions — tail attack surface.

Evidence

• uninstall_url_hijack crx setUninstallURL points to Google redirect → tabplugins.com/cursors/; classic traffic-monetization pattern.
• install_url_hijack crx onInstalled opens tabplugins.com/country-flags-cursor/ with UTM params.
• broad_host_access manifest host_permissions and content_scripts both declare *://*/*; scripting permission amplifies reach.
• dom_sink_innerhtml_userctrl crx innerHTML sink in main.4964ab1e.js; no CSP present, elevating XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• privacy_policy_third_party_sharing store Policy admits data collection + third-party sharing; no retention period disclosed.
• small_install_high_perm api 47 installs with scripting+*://*/* — elevated tail-attack-surface risk.
• no_verified_publisher store Developer FlowTab/tabplugins.com not verified; no featured badge.

Permissions Breakdown

• storage low Standard local state persistence; low risk alone.
• unlimitedStorage low Allows large local storage quota; minor risk.
• scripting high Paired with *://*/* host access: can inject JS into any page.
• *://*/* (host_permissions) high Broad host access on all sites amplifies scripting capability.
• *://*/* (content_scripts) high Content scripts run on every page; broad reach.

Pillar Scores

Bookkeeping