Top Risks

• Brand impersonation: 'Google' in title, confirmed non-owner; is_impersonation=true and not verified owner.
• Uninstall URL hijack detected (uninstall_url_hijack=true); target URL not captured but signal is present.
• NewTab-like multi-search-engine contact: extension contacts 4 search engines (bing, ddg, ecosia, google) via js_external_hosts.
• Privacy policy lacks retention disclosure and third_party_silence=true; data collection admitted without retention.
• No developer display name; developer_name is empty despite verified publisher badge.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[google], confirmed_owner=false; title uses Google trademark.
• uninstall_url_hijack crx uninstall_url_hijack=true; target not captured. Webstore +3.0 applied.
• multi_search_engine_contact crx js_external_hosts includes bing.com, duckduckgo.com, ecosia.org, google.com (4 search engines, search_engine_count=4).
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reputation discounts applied but brand_mention still +1.0.
• privacy_policy_retention_missing api policy fetched, scope_extension=true, data_collection=true, retention=false, third_party_silence=true.
• host_permissions_google_ecosystem manifest 5 host_permissions covering *.google.com, *.googleapis.com, *.youtube.com; matches stated function.
• no_developer_name store developer_name is empty string; reduces accountability despite verified publisher email.
• cve_findings_empty crx cve_findings_raw=[]; no CVE exposure detected. CVE pillar=0.0.

Permissions Breakdown

• scripting medium Can inject JS into pages; scoped to Google/YouTube host_permissions only.
• sidePanel low UI surface only, no data-exfil capability on its own.
• storage low Local preference storage; no cross-origin risk.
• tabs medium Can read URL/title of active tabs; moderate privacy surface.
• host:https://*.google.com/* medium Access to all Google properties including Gmail, Drive, etc.
• host:https://*.googleapis.com/* medium Access to Google API endpoints; potential for data access.
• host:https://*.googleusercontent.com/* low User-content CDN; lower sensitivity than core Google domains.
• host:https://*.gstatic.com/* low Static assets CDN; minimal risk.
• host:https://*.youtube.com/* medium Access to YouTube pages; matches stated function of shortcuts extension.

Pillar Scores

Bookkeeping