Top Risks

• Privacy policy fetched but scope_extension=false and third_party_sharing=true; data sharing admitted without extension-specific scoping.
• NewTab override replaces every new tab for 2M users; very high reach.
• function_constructor (new Function) in lib JS is a dynamic code execution pattern.
• innerHTML from variable (DOM-XSS sink) present; CSP mitigates but not eliminates risk.
• No developer name listed; policy lacks extension-specific data collection disclosure.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces new tab for all 2M users.
• privacy_policy_scope_mismatch crx Policy fetched; scope_extension=false, data_collection=false but third_party_sharing=true. v3.5(D) → +10.0 privacy.
• function_constructor crx new Function() in lib-DRkOfJU3.js — dynamic code execution path.
• dom_sink_innerhtml crx innerHTML from variable in index-D_OoZHl5.js; CSP present reduces severity.
• no_developer_name store developer_name is empty string; reputation starts elevated without verified identity.
• featured_by_google store is_featured_by_google=true; -2.0 reputation discount applied.
• no_bad_hosts_no_affiliate crx threat_intel: bad_host_hits=[], affiliate_hits=[], monetization_hits=[] — clean threat intel.
• cve_findings_empty crx cve_findings_raw=[]; no known vulnerable libraries detected.

Permissions Breakdown

• offscreen low Creates offscreen documents; limited capability on its own.
• unlimitedStorage low Allows large local storage; no direct data-exfil risk alone.
• idle low Detects user idle state; minimal privacy impact.
• chrome_url_overrides.newtab medium Replaces every new tab; high reach, typical for NewTab category but still elevated.

Pillar Scores

Scoring History

Bookkeeping