Top Risks

• Search provider silently overridden to Yahoo via haichatforchrome.com — monetization hijack with no functional AI value.
• Uninstall URL hijack sends user to aichatforchrome.com/ds/uninstall; install URL hijack opens /ds/success — tracking lifecycle events.
• Manifest description admits 'updates your default search provider to Yahoo' despite title claiming 'AI Chat for Chrome' — category/title mismatch.
• No developer name listed; extension domain purpose-built for this extension only; no verified publisher or featured badge.
• Privacy policy admits data collection, retention, and third-party sharing — broad scope for a 3-install search hijacker.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider is_default=true; search_url points to haichatforchrome.com, not declared provider Yahoo.
• uninstall_url_hijack crx uninstall_url_target=https://aichatforchrome.com/ds/uninstall — tracks user removal events to 3rd party.
• install_url_hijack crx install_url_target=https://aichatforchrome.com/ds/success — tracks installation events to 3rd party.
• title_description_mismatch store Title: 'AI Chat for Chrome'; description: 'updates your default search provider to Yahoo' — clear cloaking pattern.
• no_developer_name store developer_name is empty string; no verified publisher; not featured; 3 installs.
• privacy_policy_scope api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• js_external_hosts crx JS contacts aichatforchrome.com and haichatforchrome.com; haichatforchrome.com used as search/suggest endpoint.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Forces Yahoo as default search via haichatforchrome.com; is_default=true. Classic monetization hijack.

Pillar Scores

Bookkeeping