What our analysis found

Basketball Apps Srch Tab is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by other. It comes from a trusted publisher and was last updated in September 2023.

Key findings

• High

  Other

  The extension replaces every new-tab page with a full-viewport iframe loading [domain withheld] while the page's own HTML title reads '365 Opportunities Srch Tab' — the name of a different extension entirely — proving this HTML was cloned from a sibling template with only the iframe URL changed before submission. DeepSeek argues this is a benign template oversight where the developer forgot to update the title, and that the iframe loads legitimate basketball content. That explanation does not fit: the title mismatch is a static artifact baked into the shipped CRX that 339 users installed; a developer submitting to the Chrome Web Store would see the title in any browser preview, and the extension has no runtime mechanism to correct it — meaning the mismatch was either deliberate or the submission was never reviewed, both consistent with a factory-clone operation rather than a genuine basketball-info product. The publisher's 100% malicious rate across their other two extensions independently corroborates a mass-production pattern, and the maximally-permissive CSP (unsafe-inline + unsafe-eval on script-src *) gives the remotely-controlled iframe domain unrestricted code execution capability on every new-tab load.

  Show more — Other