Top Risks

• Default search-engine override silently redirects all searches to seek.searchthatweb.com — primary monetization vector.
• Uninstall URL hijack active; extension registers an uninstall callback to a third-party URL.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension.
• Extension is 27 months stale with 10K installs — zombie risk and potential for silent compromise.
• External JS host webinline-usage.streamesh.net is unrelated to developer domain — suspicious network surface.

Evidence

• search_provider_override_is_default manifest chrome_settings_overrides.search_provider.is_default=true routes all searches to seek.searchthatweb.com.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers a callback on removal to an external URL.
• privacy_policy_scope_mismatch api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic, not scoped.
• stale_extension store Last updated May 2024; months_since_update=27 with 10K installs — zombie fingerprint.
• suspicious_external_host crx js_external_hosts includes webinline-usage.streamesh.net — unrelated to declared developer domain.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension with remote JS hosts.
• not_verified_publisher store verified_publisher=false, is_featured_by_google=false; developer is unverified entity.
• webstore_zombie_plus_cves_plus_mv store 27mo stale + no CVEs found, but triple-stale fingerprint (>24mo + MV3 + no CSP) applies.

Permissions Breakdown

• declarativeNetRequest medium Can block/redirect network requests; paired with search_provider override raises concern.
• storage low Standard local data persistence, low standalone risk.
• scripting medium Can inject scripts into pages; scope limited to host_permissions but still meaningful.
• alarms low Periodic task scheduling; low risk alone.
• chrome_settings_overrides.search_provider (is_default=true) high Replaces browser default search engine; core monetization vector for search hijacking.
• host_permissions: https://*.searchthatweb.com/* medium Scoped to developer domain; enables scripting/data access to their own pages.

Pillar Scores

Bookkeeping