Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Guard Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all queries to adqor.io with tracking 'stream' parameter — monetization shape.
• Privacy policy URL returns connection error (fetch_error); policy is effectively absent, score treated as +10.
• Developer domain adqor.io does not resolve; throwaway/abandoned infrastructure raises supply-chain concern.
• Extension is 29 months stale with only 6 installs; zombie state with no accountability.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to https://guardsearch.adqor.io/?q={searchTerms}&stream=adqorioext
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but hijack flag set — tracks/redirects on removal.
• privacy_policy_unreachable api privacy_policy_classification.fetched=false; reason=fetch_error:ConnectionError. Policy treated as absent.
• developer_domain_dead api threat_intel.developer_domain_info.resolves=false for adqor.io — infrastructure gone.
• stale_extension store months_since_update=29; maps to +8.5 maintenance score.
• verified_publisher store verified_publisher=true but capped at -1.0 discount due to stale >18mo and domain not resolving (v3.5 invariant 0c).
• no_developer_name store developer_name is empty string; no 'Offered by' attribution.
• low_install_count store Only 6 installs; extension appears abandoned or test-stage with live search override.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Guard Search [browser-hijack] + malext.io malicious_extension_sentry; score 5.60 -> 8.10 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Silently replaces default search engine with adqor.io endpoint, monetization-shaped URL with stream param.

Pillar Scores

Bookkeeping