Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — EchoSearch [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search provider silently overridden to blpsearch.com with embedded tracking params (source=ea_ext_yhs_1984, pc=EAES).
• Uninstall URL hijack enabled — redirects user on removal to 3rd-party destination.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension.
• Developer email domain (explorads.com) is an ad-tech operator; extension description explicitly mentions 'analytics tracking'.

Evidence

• search_provider_override manifest chrome_settings_overrides sets blpsearch.com as default search with tracking params source=ea_ext_yhs_1984_echosearch&pc=EAES.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers an uninstall redirect to a 3rd-party URL.
• ad_tech_developer store Developer email service@explorads.com; expldata.com host in js_external_hosts implies analytics/ad data collection.
• privacy_policy_unscoped_admits_sharing api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy score.
• no_developer_name store developer_name is empty string; no 'Offered by' identity disclosed in store listing.
• install_perm_anomaly api Only 3 installs with HIGH-tier permissions (cookies, search override, host_permissions); small_install_high_perm=true.
• manifest_description_tracking manifest Description explicitly states 'intelligent redirection and comprehensive analytics tracking' confirming data collection intent.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — EchoSearch [browser-hijack] + malext.io malicious_extension_sentry; score 6.05 -> 8.55 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores extension state locally; minimal risk alone.
• cookies high Can read/write cookies on permitted hosts; enables tracking/session hijack.
• declarativeNetRequest medium Can redirect/block requests; combined with search override amplifies control.
• chrome_settings_overrides.search_provider (is_default:true) high Silently replaces default search engine; core monetization vector via blpsearch.com.
• host_permissions: https://*.blpsearch.com/* high Full cookie and request access to the replacement search provider domain.
• host_permissions: https://*.expldata.com/* high Access to analytics/data collection domain; name implies data exfiltration.

Pillar Scores

Bookkeeping