Top Risks

• Gmail developer email (lycos.search6@gmail.com) cannot verify Lycos brand ownership — impersonation unresolved.
• Privacy policy fetched but scoped to lycos.com corporate, not this extension; admits data collection and 3rd-party sharing without extension-level scope.
• Default search engine override silently redirects all searches to search6.lycos.com with tracking params.
• Extension at 18-month staleness boundary; no CSP declared on MV3 extension.
• No ratings data and low install count (9K) make quality/reputation signals weak.

Evidence

• free_webmail_dev store Developer email lycos.search6@gmail.com is free webmail; cannot confirm Lycos corporate ownership.
• search_provider_override manifest chrome_settings_overrides sets is_default=true pointing to search6.lycos.com with tracking src param.
• privacy_policy_generic api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic corporate policy.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• staleness store months_since_update=18; at the 6-12mo boundary scoring +3.5 for maintenance risk.
• no_ratings store Rating=0 with no rating count; no social proof of legitimacy.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust badge.
• clean_code_scan crx 2 JS files scanned; code_findings_raw empty, obfuscation_score=0.0, no CVEs.

Permissions Breakdown

• storage low Local key-value storage only; no cross-origin data exfil risk.
• declarativeNetRequest medium Can redirect/block requests without host inspection; medium risk without broad hosts.
• host_permissions: https://search6.lycos.com/* medium Narrow host scope to single subdomain; still allows JS injection there.
• chrome_settings_overrides.search_provider (is_default: true) medium Silently sets default search engine to lycos subdomain; classic search-hijack vector.

Pillar Scores

Bookkeeping