Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — NewTab. Search [browser-hijack] [divergent] + malext.io malicious_extension_sentry (+2.5, capped).
• Search-provider override routes all user queries through newtab.club — primary monetization/data-collection surface.
• Privacy policy is 450 chars, on a different domain (promo-newtab.club), does not scope to this extension — practically void.
• Extension is 20 months stale with no changelog; acquisition or abandonment risk is elevated.
• No JS files were scannable; functional behavior (search routing) is entirely server-side and unauditable.

Evidence

• search_provider_override manifest chrome_settings_overrides sets newtab.club as default search with is_default:true; all user queries routed to developer.
• privacy_policy_inadequate api Policy fetched (450 chars), scope_extension=false, data_collection=false — generic stub, not scoped to this extension.
• privacy_policy_domain_mismatch store Privacy policy hosted on promo-newtab.club, not newtab.club; third_party_silence=true adds +1.0.
• stale_extension store 20 months since last update; 6-12mo band scores +3.5 but 12-24mo band applies → +6.0 maintenance.
• no_js_scanned crx js_file_count=0, js_files_scanned=0; extension behavior is entirely server-side via search override.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; developer 'Bonjour' not independently verified.
• newtab_search_override_category manifest Detected as NewTab/search-override category; +2.0 webstore for search-provider override applied.
• installs_60k store 60,000 installs; +1.0 webstore blast-radius signal (>10K threshold).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — NewTab. Search [browser-hijack] [divergent] + malext.io malicious_extension_sentry; score 4.60 -> 7.10 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Sets extension as default search engine, routing all queries through newtab.club — medium-risk monetization vector.

Pillar Scores

Bookkeeping