Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension; data handling completely undisclosed.
• 35 months since last update; near-zombie status with newtab override attack surface.
• Developer uses gmail.com with no verifiable business identity; no verified publisher badge.
• uninstall_url_hijack flagged true — extension sets an uninstall redirect URL (+3.0 webstore signal).
• NewTab override with bing.com integration and no CSP; MV3 but no content-security-policy declared.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers an uninstall URL redirect, monetization/tracking signal.
• newtab_override manifest chrome_url_overrides.newtab set to data/override/index.html; replaces all new tabs.
• privacy_policy_generic store Policy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• developer_email_free_webmail store Developer email tlintspr@gmail.com; no verified business domain or publisher badge.
• maintenance_stale store Last updated July 2023, 35 months ago; approaching zombie threshold.
• no_csp manifest content_security_policy is null; no CSP declared for MV3 extension with external host calls.
• is_featured_by_google store Extension carries Google Featured badge, partial trust signal.
• host_geo_diversity api JS hosts span 2 countries (DE, IN); below geo-diversity threshold of 4.

Permissions Breakdown

• storage low Stores user preferences locally; standard low-risk permission.
• bookmarks medium Read/write access to all bookmarks; elevates data access beyond newtab function.
• contextMenus low Adds right-click menu items; limited impact.
• favicon low Reads favicon URLs; low sensitivity.
• chrome_url_overrides.newtab medium Replaces new tab page; high reach, monetization vector, category-consistent but impactful.
• host: *://api.openweathermap.org/* low Weather API; scoped, matches stated widget function.
• host: *://www.bing.com//HPImageArchive.aspx?* low Bing wallpaper API; scoped, matches stated function.

Pillar Scores

Bookkeeping