Top Risks

• New-tab override hijacks every new tab page for a wallpaper/monetization shell.
• Uninstall URL hijack sends user to tabplugins.com on removal — tracking/retention pattern.
• Install URL hijack opens 3rd-party page on install — classic traffic-monetization signal.
• Privacy policy admits data collection and third-party sharing without retention period.
• 8 external JS hosts (YouTube, Instagram, WhatsApp, ChatGPT, X, etc.) for a wallpaper tab.

Evidence

• new_tab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab page.
• uninstall_url_hijack crx setUninstallURL -> tabplugins.com/wallpaper/?utm_source=uninstallWallpaper — confirmed hijack.
• install_url_hijack crx onInstalled opens tabplugins.com/death-note-anime-wallpapers/?utm_source=installDeathNoteAnimeWallpapers.
• broad_external_hosts crx 8 JS external hosts: chatgpt.com, instagram.com, whatsapp.com, x.com, youtube.com, google.com, etc.
• privacy_policy_data_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• verified_publisher store tabplugins.com verified publisher; developer domain resolves, not throwaway.
• no_cve_no_obfuscation crx cve_findings_raw empty, obfuscation_score=0.0, code_findings_raw empty; jquery 3.7.1 clean.
• low_installs store Only 2,000 installs; low blast radius but install/uninstall URL hijacks confirmed.

Permissions Breakdown

• search medium Allows querying/modifying search provider; medium risk for NewTab monetization.
• chrome_url_overrides.newtab medium Replaces every new tab; primary monetization surface for this extension type.

Pillar Scores

Bookkeeping