Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Best Homepage Ever: Custom New Tab Launcher [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• NewTab + homepage override hijacks browser start surface on every session for 3,000 users.
• Uninstall URL redirects to Google Forms (3rd party) — tracks churn without user awareness.
• Install URL opens besthomepageever.com/welcome on install — onboarding data collection vector.
• Extension is 24 months stale (hits 24mo maintenance threshold) with no changelog visible.

Evidence

• newtab+homepage override manifest chrome_url_overrides.newtab + chrome_settings_overrides.homepage — dual browser-surface takeover.
• uninstall_url_hijack crx setUninstallURL → docs.google.com/forms/… (3rd party); Webstore +3.0 applied.
• install_url_hijack crx onInstalled opens besthomepageever.com/browser-extension/welcome/; Webstore +2.0 applied.
• verified_publisher+featured store Both badges present; Reputation discounts applied but capped at floor 2.0.
• stale_24mo store months_since_update=24; Maintenance +6.0 (12-24mo band).
• external_js_hosts crx 6 external hosts: besthomepageever.com, docs.google.com, getbootstrap.com, github.com, popper.js.org, google.com.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true → Privacy 0.0.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty → Code Quality 0.0, CVE 0.0.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Best Homepage Ever: Custom New Tab Launcher [browser-hijack] + malext.io malicious_extension_sentry; score 3.22 -> 5.72 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores user preferences locally; standard for NewTab customization.
• contextMenus low Adds right-click menu items; limited blast radius.
• chrome_url_overrides.newtab medium Replaces new tab page; high-reach surface for ad-monetization or tracking.
• chrome_settings_overrides.homepage medium Overrides browser homepage to besthomepageever.com; persistent redirect risk.

Pillar Scores

Bookkeeping