Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Direct Search Online [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search-provider override sets itself as default engine — persistent search hijacking with 100K users.
• Abandoned 46 months ago (>36mo stale) with 100K active installs — zombie attack surface.
• Uninstall URL hijack and install URL redirect to third-party directsearchonline.com page.
• Free-webmail developer (gmail) with no verified publisher status — low accountability.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Direct Search Online as default search engine (is_default: true).
• zombie_extension store Last updated October 2022 — 46 months stale with 100K installs. Triple-stale fingerprint applies.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() present; install redirect to directsearchonline.com/installed.php.
• gmail_developer store Developer email directsearchonline@gmail.com — free webmail, no verified publisher, no business badge.
• external_js_host_unknown crx JS contacts mattinastazione.com — unrelated to stated search function; unexplained third-party host.
• dom_xss_sink crx innerHTML assigned from variable in js/pop.js — DOM-XSS risk, no CSP present (MV3 default only).
• privacy_policy_adequate api Policy fetched, scoped, data_collection=true, retention=true, third_party_sharing=true — adequate.
• install_url_hijack crx onInstalled opens https://directsearchonline.com/installed.php?extid= — third-party redirect on install.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Direct Search Online [browser-hijack] + malext.io malicious_extension_sentry; score 6.75 -> 9.25 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local preferences; no direct data exfil path.
• declarativeNetRequest medium Can intercept/modify network requests via declarative rules.
• host_permission: https://search.directsearchonline.com/* medium Scoped to own search domain; allows script/fetch on that origin.
• chrome_settings_overrides.search_provider high Sets itself as default search engine — classic search-hijack vector.

Pillar Scores

Bookkeeping