Top Risks

• NewTab override explicitly self-described as 'sponsored web search' — ad-monetization shell replacing every new tab for 10K users.
• Uninstall and install URL hijacks both present — persistent redirect tracking on install/remove lifecycle.
• Privacy policy fetched, admits data collection AND third-party sharing but not scoped to this extension — worst-class privacy disclosure.
• Extension last updated 25 months ago — stale, no ongoing security maintenance.
• innerHTML DOM-XSS sink found in bundled chunk; CSP present but sink exposes users to content-injection if sponsored content is malicious.

Evidence

• newtab_override_monetized manifest chrome_url_overrides.newtab set; manifest_description explicitly states 'sponsored web search' and 'trending searches'.
• uninstall_install_url_hijack crx uninstall_url_hijack=true AND install_url_hijack=true — lifecycle redirect tracking confirmed.
• privacy_policy_admits_third_party_sharing_unscoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 Privacy (D rule).
• stale_extension store 25 months since last update; 24-36mo band = +8.5 Maintenance.
• dom_xss_sink crx innerHTML from variable in 2.ba3c3992.chunk.js; CSP present so +0.5 base, no cve/eval amplifier.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust discounts available.
• new_tab_monetization_webstore store +2.0 newtab override with monetization shape; +3.0 uninstall URL hijack; +2.0 install URL hijack.
• install_count_1k store 10,000 installs — +1.0 Webstore (>10K threshold met).

Permissions Breakdown

• search medium Can intercept and redirect search queries; core monetization vector for NewTab shells.
• storage low Local key-value storage; low standalone risk.
• chrome_url_overrides.newtab high Replaces every new tab; high-reach monetization surface, self-described as sponsored search.

Pillar Scores

Bookkeeping