Top Risks

• Privacy policy is generic Google account policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Extension not updated in ~32 months; bundled jQuery 3.3.1 carries 3 unpatched medium XSS CVEs.
• New-tab override replaces every new-tab page for all 50K users.
• No CSP present on MV3 extension with vulnerable jQuery and external bootstrap host.
• Developer name listed only as 'publisher'; limited accountability signal.

Evidence

• privacy_policy_generic store Policy URL is Google Account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• stale_extension store Last updated Oct 2023; 32 months since update → Maintenance +8.5.
• cve_jquery_3_3_1 crx 3 medium-severity CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023) in jquery@3.3.1; fixed_in 3.5.0.
• no_csp manifest content_security_policy is null; no CSP present on MV3 extension.
• newtab_override manifest chrome_url_overrides.newtab set; replaces new tab for all users.
• external_hosts crx js_external_hosts: chrome.google.com, getbootstrap.com — 2 distinct external domains.
• featured_by_google store is_featured_by_google=true; provides partial reputation mitigation.
• developer_identity store developer_name='publisher'; email gsommer@oeg.com.br; domain resolves, not throwaway.

CVE Exposures (3)

Permissions Breakdown

• storage low Stores user preference for custom URL; minimal risk.
• chrome_url_overrides.newtab medium Replaces new tab page; medium risk per rubric rule (a).

Pillar Scores

Bookkeeping