Top Risks

• Critical CVE-2021-23358 in bundled underscore@1.8.3 (arbitrary code execution); no CSP amplifies risk.
• New tab override replaces every new tab; uninstall URL hijacks to 3rd-party newtabthemebuilder.com.
• Privacy policy is generic Google account policy — does not scope to this extension at all (admitted data collection + 3rd-party sharing).
• Extension is 31 months stale (MV3 but no updates since Nov 2023); CVEs unfixed.
• Free-webmail developer (gmail) with no developer name and no verified publisher badge.

Evidence

• critical_cve_underscore crx underscore@1.8.3 has CVE-2021-23358 (critical ACE); fixed in 1.12.1. No CSP present — v2 ×1.5 amplifier applies.
• newtab_override manifest chrome_url_overrides.newtab set to index.html — replaces every new tab page.
• uninstall_url_hijack crx uninstall_url_target=https://newtabthemebuilder.com/feedback — 3rd-party redirect on uninstall (+3.0 Webstore).
• install_url_hijack crx onInstalled opens ./index.html — install URL hijack signal (+2.0 Webstore).
• generic_privacy_policy store Privacy policy is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• stale_extension store 31 months since last update; CVEs present and unfixed. v2 triple-stale fingerprint +2.0 Webstore.
• free_webmail_no_dev_name store Developer email newtabthemescontact@gmail.com; developer_name empty; no verified publisher — Reputation floor 7.5.
• dom_xss_sink_no_csp crx innerHTML userctrl sink in main.js with csp_present=false and CVEs present → +2.0 Code Quality (FIX B).

CVE Exposures (2)

Permissions Breakdown

• chrome_url_overrides.newtab medium Replaces new tab page — high-visibility hijack surface, scored as MEDIUM override permission.

Pillar Scores

Bookkeeping