Every byte I read in the bundled 2.22.33 package is a clean local new-tab page: only opens, sets an uninstall URL to the publisher's own [domain withheld], seeds storage defaults and proxies chrome.topSites.get back to the page; renders those topSites into a local <li> menu and never transmits them;:212 submits search to a hardcoded [domain withheld], and,, and are entirely chrome.storage.local plus DOM work. There is no to any endpoint, no, no chrome., no remote script and no host_permissions at all in the bundle, so the 0.88 ML score is not supported by this code - the XMLHttpRequest, createElement('script') and atob hits all live in, which are a webpack-split 3D bundle (:3 exports e.BABYLON) that never loads, i.e. dead vendor code. The one thing I cannot clear, and the reason this is not likely_benign, is the manifest mismatch: the live CWS listing declares permissions ['search'] and host_permissions ['[domain withheld]'] - corroborated independently by chrome-stats' 'access-to-specific-domain: [domain withheld]' - while the bundle declares and no host access, so the published build has acquired a remote endpoint and a search capability that nothing in the reviewed bytes uses and that the listing discloses no data collection for. Contradicting the ML signal: chrome-stats rates impact likelihood, the publisher carries Google's trusted-publisher badge with (1%) malicious siblings, and the 'malware' internal note is a bulk feed import with no affected version. Supporting caution: (12%) of the permhash cluster is flagged, though I found none of that cluster's code patterns here. Hygiene notes, not findings::9-12 interpolates unescaped topSites titles into innerHTML (self-XSS surface on the extension's own page only), and the:255 email-share body still points at an unrelated [domain withheld] template. Coverage caveat: seven vendor scripts named by (, jquery., jquery-ui., sweetalert., popper., bootstrap., TweenMax.) account for roughly 1.6 MB of the reported 1.83 MB of JS and were not supplied in this bundle, so they were not reviewed.