Is Pokemon Retro Themes - Bring old-school Pokemon vibes to your browser safe?
We analyzed Pokemon Retro Themes - Bring old-school Pokemon vibes to your browser version 3.3's actual code and gave it a 82/100 trust score. This is a…
Bottom line
This is a mostly purpose-aligned themed new-tab extension with moderate access and limited privacy concerns.
What it can access
It controls the new-tab page, stores dashboard data, sends typed searches for suggestions, and can use microphone input after a click, which broadly fits its purpose.[Q1][Q5][Q6]
Security weaknesses
The main concerns are a promotional notification and reduced readability from compiled code, while no dangerous code execution or broad website access was found.[Q8][Q10][Q11]
Signs of misuse
It sends dashboard search text to Google for suggestions and shows a delayed rating prompt, but no unexplained tracking, deception, or harmful misuse was established.[Q6][Q8][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, search, notifications, alarms and context-menu access and overrides the new-tab page. The permissions match its dashboard, search and rating-prompt features; network host access is limited to Google's suggestion services.
Declares storage, search, notifications, alarms and contextMenus, overrides newtab, and grants only suggestqueries.google.com host access. — manifest.json:22-41
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No content_scripts entry or broad website host permission is present. — manifest.json:1-42
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No website execution capability is declared. — manifest.json:1-42
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
No cookies, history, bookmarks or downloads permission is declared. — manifest.json:22-28
The optional lastQueries list keeps at most ten searches in the extension's local persisted store. — newtab.js:10-12
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads custom wallpaper and music files only after the user selects them. Its voice-search button invokes browser speech recognition, which uses microphone input after an explicit click.
User-created hidden file inputs accept selected audio, image or video files and store them locally. — SettingsPage.js:7-12
we creates webkitSpeechRecognition and starts it only from the voice-search button handler. — newtab.js:10-14
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Typed search prefixes are sent to suggestqueries.google.com when suggestions are enabled, submitted searches go to the chosen search provider, and custom shortcut domains are sent to Google's favicon service. Voice input may be processed by the browser's speech provider.
Ce fetches Google's complete/search endpoint with the URL-encoded current input; the input handler calls it after a 150 ms debounce. — newtab.js:10-12
Submitted text is passed to chrome.search.query or substituted into a user-configured search URL. — newtab.js:12
A custom shortcut uses https://www.google.com/s2/favicons?domain=<hostname> for its icon. — newtab.js:18
Voice search uses webkitSpeechRecognition with the selected recognition language. — newtab.js:10-14
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
The only fetch parses a suggestion JSON array and stores the strings for display. — newtab.js:10
Loads packaged scripts and styles from extension-relative paths. — new-tab.html:8-12
Inventories bundled application modules and all media/font/icon assets. — inventory.json:1-1046
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically replaces every new tab and schedules a rating-request notification one hour after installation. The new-tab replacement is advertised; the promotional notification is not needed for core functionality.
Overrides Chrome's new-tab page with new-tab.html. — manifest.json:34-36
Creates ask-for-ratings-alarm one hour after installation and shows a persistent rate/later notification. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces the browser's new-tab page and can initiate searches. It does not silently change Chrome's configured default search provider, homepage or proxy.
Declares search permission and a new-tab override, but no search-provider, homepage or proxy setting declaration. — manifest.json:22-36
Built-in search calls chrome.search.query, which uses the user's current search provider. — newtab.js:12
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The React application and dependencies are compiled into large minified bundles, which reduces readability, but feature modules, strings, services and services flows remain traceable and no deliberate concealment was found.
Approximately 299 KB compiled bundle includes React, state management, drag-and-drop code and the main application. — newtab.js:1-18
Approximately 40 KB compiled settings chunk retains named user-facing logic and fixed links. — SettingsPage.js:1-12
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Lazy imports reference literal packaged files such as ./SettingsPage.js and ./EditingPane.js. — newtab.js:18
The complete worker contains no dynamic-code execution primitive. — background.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, webNavigation or content-script access is declared. — manifest.json:1-42
lastQueries records only explicitly submitted dashboard search strings in chrome.storage.local. — newtab.js:10-12
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Migration uses crypto.randomUUID only as the id of each local shortcut. — background.js:1
No identifier is included in suggestion, favicon or search requests. — newtab.js:10-18
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies permission or website content-script access is present. — manifest.json:1-42
Does it record typing, form entries, clipboard contents, or screenshots?
Its own new-tab search field sends partial text to Google as it is typed when suggestions are enabled, which is the default. It does not monitor typing on ordinary websites, clipboard data or screenshots.
suggestionsEnabled defaults true; onChange schedules Ce(current text) after 150 ms and Ce fetches Google's suggestion API. — newtab.js:10-12
No website, clipboard or capture access is declared. — manifest.json:1-42
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Alarm and context-menu handlers map to fixed rating, tutorial, source-code and local thank-you actions. — background.js:1
No externally_connectable declaration is present. — manifest.json:1-42
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Search uses Chrome's provider or a locally configured template; shortcuts navigate to their stored URL. — newtab.js:12-18
The only promotion is a transparent request to rate the extension in the Chrome Web Store. — background.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy or downloads permission is declared. — manifest.json:22-41
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Host access is limited to an HTTPS Google suggestion endpoint and nativeMessaging is absent. — manifest.json:22-41
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Import validates a JSON object, recognizes known stores and skips unknown keys before updating local state. — SettingsPage.js:7
IndexedDB files become object URLs used by image, video or audio elements. — newtab.js:10
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No externally_connectable, content_scripts or web_accessible_resources entry is present. — manifest.json:1-42
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Install-time delay and exponential rescheduling apply only to the clearly labeled rating notification. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Most package size is attributable to named wallpaper, video, song, font and icon assets. — inventory.json:1-1046
Runtime media work is local rendering and playback, with no computational worker or mining loop. — newtab.js:10-18
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No website execution capability is declared. — manifest.json:1-42
The new-tab search form prevents its own default submission and calls the explicit search routine. — newtab.js:12