Top Risks

• FORCE BLOCK: management + new-tab/search override — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy is Google's generic account policy — not scoped to this extension; collects and shares data with third parties per policy.
• Four medium-severity jQuery CVEs (v2.0.3) bundled; fix requires upgrade to 3.5.0+; sandbox CSP allows unsafe-eval/unsafe-inline compounding XSS risk.
• management + <all_urls> combo allows enumeration/disabling of other extensions across every site.
• NewTab override with dynamic script creation (require.js) and eval usage in AngularJS; 12 external JS hosts contacted including social/ad-adjacent domains.

Evidence

• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy score.
• jquery_cve_bundle crx jquery@2.0.3 carries 4 medium CVEs (CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); none fixed at bundled version.
• sandbox_csp_unsafe_eval crx Sandbox CSP: script-src 'self' 'unsafe-inline' 'unsafe-eval' — weakens XSS protections and amplifies CVE risk.
• newtab_override_with_all_urls manifest chrome_url_overrides.newtab + <all_urls> + management permission — high capability for a NewTab extension.
• eval_and_function_constructor crx eval_user_input and function_constructor found in angular.js and require.js; dynamic script creation in require.js.
• 12_external_js_hosts crx js_external_hosts includes twitter.com, www.amazon.com, www.facebook.com, angularjs.org, awesomehq.com — 12 distinct domains.
• verified_publisher_featured store Extension is verified publisher and featured by Google; discounts capped due to no monetization hits; reputation floor applied at 2.0.
• maintenance_current store Last updated April 15, 2025 (~2 months ago); maintenance score 0.0.

Permissions Breakdown

• management high Can enumerate, enable, disable, or uninstall other extensions — significant abuse surface.
• tabs medium Access to tab URLs, titles, and navigation — privacy risk combined with broad host access.
• storage low Local key-value storage; standard for extension settings.
• unlimitedStorage low Removes storage quota; low standalone risk but worth monitoring.
• chrome://favicon/ low Read favicons for display; limited privacy exposure.
• <all_urls> high Broad host access; NewTab override justifies some host access but <all_urls> is broader than needed.
• chrome_url_overrides.newtab medium Replaces every new tab — high reach, monetization and redirect risk.

Pillar Scores

Scoring History

Bookkeeping