Bookmark Plus New Tab

The installed ZIP uses Manifest v2 and declares 11 permissions including webRequest, webRequestBlocking, and <all_urls>, granting the ability to intercept and block any network request. The live CWS listing instead advertises a Manifest v3 extension with only 5 low-risk permissions (history, unlimitedStorage, favicon, storage, topSites). This is a material mismatch — the published listing is designed to misrepresent the actual capabilities of the installed extension to users and reviewers.

{  "manifest_version": 2,  "permissions": [    "tabs",    "history",    "unlimitedStorage",    "chrome://favicon/",    "contextMenus",    "storage",    "topSites",    "activeTab",    "webRequest",    "webRequestBlocking",    "<all_urls>"  ]}

Every URL a user bookmarks or adds to the new tab page is transmitted to http://mini.s-shot.ru (a third-party Russian screenshot service) as a query parameter, over unencrypted HTTP. The publisher domain is bookmark-plus.com and no data collection is disclosed in the CWS listing. This constitutes undisclosed forwarding of potentially sensitive browsing URLs to an unrelated third party.

createPreview(a, b) {  this.resizeImg('http://mini.s-shot.ru/?' + a, (c) => {    null === c ? this.hiddenCapture(a, (a) => this.resizeImg(a, (a) => b(a))) : b(c)  })}

When the screenshot service fails, the extension opens a fully offscreen popup window (positioned at left:1e6, top:1e6) that navigates to the target URL, waits for it to fully load, then silently captures a screenshot with captureVisibleTab. The target URL is fully loaded and rendered with JavaScript execution without any visible indicator to the user. While used here for bookmark thumbnails, this invisible-browser-visit capability combined with <all_urls> access is a high-privilege covert browsing pattern.

hiddenCapture(a, b) {  chrome.windows.create({    url: a,    focused: !1,    width: 100,    height: 100,    left: 1e5,    top: 1e5,    type: 'popup'  }, (a) => {    if (!a.tabs || !a.tabs.length) return chrome.windows.remove(a.id), b(null);    const c = a.tabs[0].id;    let d;    chrome.tabs.update(c, {      muted: !0    }), chrome.windows.update(a.id, {      width: 1200,      height: 800,      left: 1e6,      top: 1e6    });    const e = setTimeout(() => {      clearInterval(d), chrome.windows.remove(a.id), b(null)    }, 6e4);    d = setInterval(() => {      chrome.tabs.get(c, (c) => {        'complete' === c.status && (clearInterval(d), clearTimeout(e), setTimeout(() => {          chrome.tabs.captureVisibleTab(a.id, (c) => {            chrome.windows.remove(a.id, () => b(c))          })        }, 500))      })    }, 200)  })}