Top Risks

• Broad host permissions (https://*/* and http://*/*) combined with scripting allow content injection on any site.
• Privacy policy is Google's generic account policy — not scoped to this extension; data handling completely undisclosed.
• Dynamic script loading and new Function() constructor in bundled JS create code-execution surface.
• NewTab override captures all new-tab navigations; free-webmail dev with no developer name reduces accountability.
• Low install count (14) with HIGH-tier permissions is a tail-attack-surface anomaly.

Evidence

• broad_host_access manifest host_permissions include https://*/* and http://*/* granting access to all websites.
• newtab_override manifest chrome_url_overrides.newtab set to web/index.html — replaces all new tab pages.
• privacy_policy_generic store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• code_dynamic_script crx script_src_dynamic in app.ea566fe1.js — webpack dynamic chunk loading via DOM script injection.
• code_function_constructor crx new Function() constructor used in app.ea566fe1.js; risk depends on input source.
• developer_identity store developer_name is empty; gmail.com email; verified_publisher=true but no business identity.
• tail_attack_surface api Only 14 installs with high-tier permissions (scripting + broad host); install_perm_anomaly flagged.
• third_party_host crx js_external_hosts includes bres.vmx.wang — unrelated domain to remeins.com brand.

Permissions Breakdown

• newtab override medium Replaces browser new tab page; captures all new tab navigations.
• storage low Stores local user data; low standalone risk.
• scripting high Can inject scripts into pages; combined with broad host access is high risk.
• tabs medium Access to tab URLs and metadata across all open tabs.
• activeTab low Scoped to current tab on user action; mitigated by activeTab scope.
• contextMenus low Adds right-click menu entries; low risk in isolation.
• search medium Can query browser search engine; relevant to NewTab search surface.
• https://*/* high Broad host access across all HTTPS sites; enables scripting on any page.
• http://*/* high Broad host access across all HTTP sites; enables scripting on any page.
• https://api.remeins.com/ medium Extension-specific backend API endpoint.
• https://static.remeins.com/ medium Extension-specific static asset host.
• https://bres.vmx.wang/ medium Third-party domain (vmx.wang) with unclear ownership; warrants scrutiny.
• https://remeins.com/ medium Extension developer domain.

Pillar Scores

Bookkeeping