Top Risks

• Default search engine override silently routes all browser searches to torry.io, a high-capability data collection point.
• Privacy policy fetched but admits data collection and third-party sharing without scoping to this extension — worst-class privacy disclosure.
• No CSP present; MV3 mitigates remote-code risk but absence still weakens content integrity.
• Install URL hijack detected — onInstalled opens an external URL, a common ad/monetization shell pattern.
• Developer name absent; verified publisher status partially offsets but stale 16-month update cycle limits trust.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Torry as default search engine; all queries go to torry.io/search.
• privacy_policy_inadequate api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — scores +10.0 per v3.5 rule D.
• install_url_hijack crx install_url_hijack=true; target null but onInstalled opens external URL — monetization shell indicator.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discounts applied but capped due to months_since_update=16>12.
• no_csp manifest content_security_policy is null; MV3 provides some default protection but no explicit CSP declared.
• stale_update store Last updated February 2025; 16 months since update triggers +6.0 maintenance score.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, cve_findings_raw empty — clean code surface.
• developer_name_missing store developer_name is empty string; verified publisher and torry.io domain partially offset anonymous dev signal.

Permissions Breakdown

• chrome_settings_overrides.search_provider (default) high Sets Torry as default search engine, routing all user searches through torry.io.

Pillar Scores

Bookkeeping