Top Risks

• New tab override with install/uninstall URL hijack patterns
• Privacy policy is generic Google policy, not scoped to this extension
• Developer uses free webmail with no business website
• Extension is 17 months without updates (abandonment risk)
• Contacts multiple external hosts including social media platforms

Evidence

• uninstall_url_hijack manifest Extension sets uninstall URL to third-party site
• install_url_hijack manifest Extension opens third-party URL on install
• newtab_override manifest Overrides chrome_url_overrides.newtab with newtab.html
• privacy_policy_generic store Links to generic Google policy, not extension-specific
• developer_identity store Developer uses gmail.com with no business website
• staleness store 17 months since last update
• external_hosts crx Contacts 7 external hosts including social media platforms
• missing_csp crx No Content Security Policy defined

Permissions Breakdown

• search medium Can read search queries and modify search results
• chrome_url_overrides.newtab high Overrides new tab page, high potential for monetization/redirect

Pillar Scores

Bookkeeping