Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware] (+2.0, capped).
• Privacy policy admits data collection and third-party sharing without scoping to this extension — scores maximum privacy risk.
• NewTab override + <all_urls> + scripting: broad capability to inject into all pages from a high-traffic replacement page.
• Developer uses free-webmail (gmail) with no developer name declared; identity accountability is low.
• 18 months since last update; exactly at stale threshold; verified-publisher discount capped per v3.5 rule 0c (months_since_update >= 18).

Evidence

• newtab_override manifest chrome_url_overrides.newtab set to newtab.html — replaces every new tab for 50K users.
• broad_host_access manifest <all_urls> host permission combined with scripting API enables injection on any site.
• privacy_policy_generic_admits_sharing api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D → +10.0 privacy.
• free_webmail_dev_no_name store developer_email=resllaimbaos@gmail.com, developer_name empty; identity unverifiable.
• verified_publisher_featured store Both verified_publisher and is_featured_by_google true; discounts apply but capped at 18mo stale.
• stale_18mo store months_since_update=18; maintenance +6.0; verified-publisher discount capped per 0c (>=18mo).
• no_cve_no_bad_hosts api cve_findings_raw empty, bad_host_hits empty, affiliate_hits empty — no threat-intel hits.
• code_clean crx obfuscation_score=0.0, code_findings_raw empty, 9 JS files scanned; no malicious signals detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Palant affiliate fraud cluster (name unconfirmed) [adware]; score 5.38 -> 7.38 (+2.0 cap 2.5).

Permissions Breakdown

• bookmarks medium Reads all bookmarks; relevant for dashboard but grants broad history access.
• storage low Standard local data persistence.
• unlimitedStorage low Allows large local data; low direct risk.
• activeTab low Scoped to user-initiated interactions only.
• favicon low Reads site favicons; low sensitivity.
• search medium Can query and manipulate browser search; combined with newtab override raises concern.
• scripting medium Can inject scripts into pages; combined with <all_urls> elevates risk.
• contextMenus low Adds right-click menu items; limited risk.
• <all_urls> high Broad host access; combined with scripting allows content injection on all sites.
• chrome_url_overrides.newtab medium Replaces new tab page; core function but monetization surface.

Pillar Scores

Bookkeeping