Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — scores maximum privacy risk per v3.5 rule D.
• Search-provider override sets Perplexity as default engine and overrides homepage/startup pages, altering core browser behavior.
• Extension is 19 months stale (>18mo) with a search/homepage override; maintenance risk elevated.
• install_url_hijack and uninstall_url_hijack both fire to perplexity.ai — standard for the brand but still a behavioral signal.
• Rating of 3.6 with 200K installs suggests user dissatisfaction; no review red-flags detected but low score is noted.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to Perplexity extension; data_collection+third_party_sharing=true.
• search_provider_override manifest chrome_settings_overrides sets Perplexity as default search engine, homepage, and startup page.
• stale_extension store Last updated November 15, 2024; 19 months since update — exceeds 18mo stale threshold.
• install_uninstall_url_hijack manifest onInstalled opens perplexity.ai; uninstall URL also points to perplexity.ai/?uninstall_default_search_extension=true.
• cookies_permission_high manifest cookies declared; host_permissions scoped to perplexity.ai only, limiting blast radius but still HIGH tier.
• no_csp manifest content_security_policy is null; MV3 has strict default so no v2 penalty, but noted.
• verified_publisher_false store verified_publisher=false; developer domain perplexity.ai resolves and is not throwaway, partial mitigation.
• cve_clean crx cve_findings_raw is empty; no bundled vulnerable libraries detected.

Permissions Breakdown

• cookies high Can read/write cookies; scoped only to perplexity.ai host, but still a HIGH-tier permission.
• chrome_settings_overrides.search_provider (is_default=true) medium Overrides default search engine to perplexity.ai; MEDIUM per rubric, matches stated function.
• chrome_settings_overrides.homepage medium Sets homepage to perplexity.ai; consistent with stated purpose but alters browser behavior.
• host_permissions: https://www.perplexity.ai/* low Narrowly scoped to dev's own domain; low blast radius.

Pillar Scores

Bookkeeping