Top Risks

• NewTab override replaces every new tab; combined with search permission enables search monetization.
• Uninstall URL hijack and install URL hijack both active — classic traffic-monetization shell pattern.
• No CSP defined (MV3 fallback applies but CSP absent increases risk surface).
• Privacy policy admits data collection and third-party sharing without retention disclosure.
• months_since_update is unknown (null) — maintenance posture unverifiable, scored worst case.

Evidence

• newtab_override manifest chrome_url_overrides.newtab present — replaces every new tab page with extension-controlled HTML.
• uninstall_url_hijack crx uninstall_url_hijack=true; runtime.setUninstallURL() called — standard monetization-shell signal.
• install_url_hijack crx install_url_hijack=true; onInstalled opens 3rd-party URL — stacks with uninstall hijack.
• js_external_hosts crx Extension references chatgpt.com, instagram.com, x.com, youtube.com — 7 external hosts, 2 countries.
• privacy_policy_gaps api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_csp manifest content_security_policy is null — no explicit CSP declared for MV3 extension.
• maintenance_unknown store last_updated and months_since_update both null; maintenance posture unknown, scored maximum.
• search_permission_plus_newtab manifest search permission + newtab override = new-tab override with monetization shape per rubric.

Permissions Breakdown

• search medium Allows overriding search provider; medium risk paired with newtab override.
• chrome_url_overrides.newtab high Replaces every new tab page; high monetization/surveillance surface area.

Pillar Scores

Bookkeeping