Top Risks

• Install and uninstall URL hijacking detected
• No Content Security Policy (CSP) defined
• New tab page override with external script loading
• DOM-XSS vulnerability in news.js
• Privacy policy lacks data retention disclosure

Evidence

• url_hijack manifest install_url_hijack and uninstall_url_hijack are true; redirects users on lifecycle events.
• newtab_override manifest chrome_url_overrides.newtab set to newtab.html; replaces browser start page.
• missing_csp crx content_security_policy is null; allows unrestricted script execution contexts.
• dom_xss crx dom_sink_innerhtml_userctrl found in js/news.js; unsanitized HTML injection risk.
• external_hosts crx Contacts 7 external domains including social media and search engines.
• privacy_gap api Privacy policy scoped but missing retention details; third-party sharing allowed.

Permissions Breakdown

• search medium Allows reading and modifying search settings, potential for search hijacking.
• host_permissions: https://tabplugins.com/* medium Grants access to developer domain; necessary for wallpaper fetching but expandable.
• chrome_url_overrides.newtab medium Replaces new tab page; high user impact surface.

Pillar Scores

Bookkeeping