Top Risks

• Default search engine hijacked to api.pdfsearchhelper.com via chrome_settings_overrides; core monetization/surveillance vector.
• Privacy policy is System1 corporate policy (system1.com) — scope_extension=false, admits data collection and third-party sharing; scored +10.
• Free-webmail dev (s1searchsafe@gmail.com), no developer name, no verified publisher — anonymous operator.
• Both install and uninstall URL hijacks flagged; classic search-monetization shell pattern.
• 21 installs with search-engine override + anonymous dev signals a recently deployed monetization extension.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing all searches through api.pdfsearchhelper.com.
• uninstall_url_hijack crx uninstall_url_hijack=true; classic monetization/tracking shell pattern.
• install_url_hijack crx install_url_hijack=true; opens third-party page on install.
• privacy_policy_generic api Policy at system1.com admits data collection + third-party sharing; scope_extension=false. Scored max.
• anonymous_developer store developer_name empty, free-webmail email s1searchsafe@gmail.com, no verified publisher badge.
• system1_operator store Privacy policy domain system1.com suggests System1 search monetization operator behind this extension.
• stale_extension store 13 months since last update; maintenance score elevated to 6.0 (6-12 month band).
• low_install_search_override store Only 21 installs with default search override — typical early-stage monetization shell deployment.

Permissions Breakdown

• storage low Local storage for settings; low standalone risk.
• declarativeNetRequest medium Can intercept/modify network requests; medium risk without broad host access.
• host_permissions: https://*.pdfsearchhelper.com/* medium Narrow host access to dev-controlled domain only.
• chrome_settings_overrides.search_provider (is_default=true) high Silently hijacks default search engine to api.pdfsearchhelper.com; core monetization vector.

Pillar Scores

Bookkeeping