Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Surf Safely [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search-provider override set as default: routes all searches through surfsafe.ai, monetization/surveillance risk.
• Free-webmail dev email (exedeveloper91@gmail.com) with numbered alias and no developer name; unverifiable identity.
• Privacy policy too short (81 chars), not scoped to extension, silent on third-party sharing — effectively no policy.
• declarativeNetRequestWithHostAccess enables network-request blocking/redirecting aligned with search override.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Surf Safely as default search via surfsafe.ai/explore/rd/search/?q={searchTerms}
• free_webmail_numbered_alias store Developer email exedeveloper91@gmail.com — numbered Gmail alias, no developer name, no verified business domain.
• privacy_policy_inadequate api Policy length 81 chars, scope_extension=false, data_collection=false, third_party_silence=true — stub policy.
• install_url_hijack store install_url_hijack=true; extension opens a URL on install, typical of monetization/SEO shells.
• small_install_high_perm_anomaly api Only 6 installs but has declarativeNetRequestWithHostAccess + search override; tail-attack-surface flag.
• multi_search_engine_newtab_analog api search_engine_count=3 (brave, duckduckgo, startpage) in js_external_hosts; aggregator/monetization pattern.
• verified_publisher_with_gmail store verified_publisher=true but dev email is Gmail — verification doesn't offset unverifiable dev identity signals.
• no_csp manifest content_security_policy is null/absent on MV3; v2 fix (b) applies: +2.0 network for MV2 not triggered but noted.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Surf Safely [browser-hijack] + malext.io malicious_extension_sentry; score 4.21 -> 6.71 (+2.5 cap 2.5).

Permissions Breakdown

• contextMenus low Adds right-click menu items; minimal risk surface.
• storage low Local preference storage; no cross-site data exposure.
• declarativeNetRequestWithHostAccess high Can block/redirect network requests; paired with search-provider override heightens risk.
• host_permissions: *://surfsafe.ai/* low Narrow host scope limited to dev domain only.
• chrome_settings_overrides.search_provider (is_default=true) medium Overrides default search engine; search-provider monetization vector.

Pillar Scores

Bookkeeping