Top Risks

• Default search-engine override routes all queries through viewforms.org — classic ad-monetization hijack.
• Uninstall and install URL hijack flags both set; extension redirects on install/uninstall to unknown 3rd-party.
• Developer email is free Gmail (FormsForAll2025@gmail.com); no verified publisher; throwaway-account pattern.
• Privacy policy admits data collection AND third-party sharing but is not scoped to this extension — worst-case disclosure.
• Rating of 1/5 with 8,000 installs; 15-month stale update window; high-capability search override with no accountability.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider is_default=true pointing to viewforms.org; hijacks all browser searches.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension sets uninstall redirect URL to undisclosed 3rd-party target.
• install_url_hijack crx install_url_hijack=true; extension opens undisclosed URL on install — classic traffic-monetization pattern.
• free_webmail_developer store Developer email FormsForAll2025@gmail.com; no verified publisher; numbered-alias-style name.
• privacy_policy_bad_scope api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — admits sharing, not scoped to extension.
• cookies_permission_with_search_override manifest cookies permission combined with default search override amplifies data-exfil risk on all searches.
• low_rating store Rating 1.0/5 with 8,000 installs; strong negative user signal for an extension with search override capability.
• stale_maintenance store months_since_update=15; falls in 12-24mo band (+6.0 maintenance score); no changelog visible.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• cookies high Can read/write cookies scoped to granted hosts; combined with search override raises risk.
• host_permissions: https://viewforms.org/* medium Narrow host scope but dev domain is gmail-linked, unverified operator.
• chrome_settings_overrides.search_provider (is_default=true) high Silently replaces default search engine; classic monetization vector.

Pillar Scores

Bookkeeping