Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Pinukim - חיפוש סרטים וסדרות [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search engine forcibly redirected to searchsafe.live — all user queries captured by unknown operator.
• Privacy policy URL unreachable (ConnectTimeout); data practices completely undisclosed.
• Developer is anonymous (no name, free Gmail, no verified publisher) operating a search-override extension.
• Uninstall URL hijack configured (redirects to google.com — suspicious use of setUninstallURL by a search hijacker).

Evidence

• search_provider_override manifest chrome_settings_overrides sets searchsafe.live as default search engine (is_default=true) for all queries.
• privacy_policy_unreachable api fetch_error:ConnectTimeout on https://searchsafe.live/legal/privacy.php — policy cannot be evaluated.
• free_webmail_no_dev_name store Developer gadgetzoneil@gmail.com, no developer_name set; anonymous operator running search override.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL set to https://www.google.com — unusual for legitimate extensions.
• low_rating store Rating 2.2; users likely experiencing unwanted search/homepage overrides.
• stale_update store Last updated June 2025, 14 months ago; no active maintenance visible.
• search_override_category_mismatch store Extension claims to be a movie/series finder but functions as a search-engine hijacker via searchsafe.live.
• no_csp manifest content_security_policy is null on MV3 extension; no declared CSP protections.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Pinukim - חיפוש סרטים וסדרות [browser-hijack] + malext.io malicious_extension_sentry; score 6.56 -> 9.06 (+2.5 cap 2.5).

Permissions Breakdown

• tabs medium Can read tab URLs/titles; moderate risk on its own but amplified by search-provider override.
• chrome_settings_overrides.search_provider (is_default=true) high Forces all search queries through searchsafe.live; monetization/data-collection vector.
• chrome_settings_overrides.homepage medium Overrides browser homepage to searchsafe.live without user explicit choice post-install.
• chrome_settings_overrides.startup_pages medium Sets startup page; hijacks new session to searchsafe.live.

Pillar Scores

Bookkeeping