Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — View Forms [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search-engine override routes all queries through viewforms.org — classic ad-monetization hijack.
• Uninstall and install URL hijack flags both set; extension redirects on install/uninstall to unknown 3rd-party.
• Developer email is free Gmail (FormsForAll2025@gmail.com); no verified publisher; throwaway-account pattern.
• Privacy policy admits data collection AND third-party sharing but is not scoped to this extension — worst-case disclosure.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider is_default=true pointing to viewforms.org; hijacks all browser searches.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension sets uninstall redirect URL to undisclosed 3rd-party target.
• install_url_hijack crx install_url_hijack=true; extension opens undisclosed URL on install — classic traffic-monetization pattern.
• free_webmail_developer store Developer email FormsForAll2025@gmail.com; no verified publisher; numbered-alias-style name.
• privacy_policy_bad_scope api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — admits sharing, not scoped to extension.
• cookies_permission_with_search_override manifest cookies permission combined with default search override amplifies data-exfil risk on all searches.
• low_rating store Rating 1.0/5 with 8,000 installs; strong negative user signal for an extension with search override capability.
• stale_maintenance store months_since_update=15; falls in 12-24mo band (+6.0 maintenance score); no changelog visible.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — View Forms [browser-hijack] + malext.io malicious_extension_sentry; score 6.94 -> 9.44 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• cookies high Can read/write cookies scoped to granted hosts; combined with search override raises risk.
• host_permissions: https://viewforms.org/* medium Narrow host scope but dev domain is gmail-linked, unverified operator.
• chrome_settings_overrides.search_provider (is_default=true) high Silently replaces default search engine; classic monetization vector.

Pillar Scores

Bookkeeping