Top Risks

• Search engine override sets octagonfind.com as default, redirecting all queries to an unverified provider.
• Developer uses free Gmail address with no stated organization; unverifiable identity behind a search hijack extension.
• Extension is 28 months stale — zombie risk, abandoned or pre-acquisition asset.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension (generic policy).
• Uninstall URL hijack flag set; extension registers a third-party uninstall redirect.

Evidence

• search_provider_override manifest chrome_settings_overrides sets octagonfind.com as default search engine (is_default=true).
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers a post-uninstall redirect URL.
• free_webmail_developer store Developer email is tinsleychristopher46@gmail.com; no business name or verified organization.
• stale_extension store Last updated May 2024; 28 months since update — zombie tier.
• privacy_policy_generic api Policy fetched but scope_extension=false; admits data collection and third-party sharing without extension-specific scope.
• verified_publisher_but_gmail store verified_publisher=true but dev email is Gmail; discount capped per v3.5 invariant 0c (stale>18mo).
• no_rating store Rating=0, rating_count=0; no user feedback signal available.
• no_csp manifest content_security_policy=null; MV3 has strict default but no explicit CSP declared.

Permissions Breakdown

• storage low Stores local settings; low risk in isolation.
• declarativeNetRequest medium Can block/redirect network requests; medium risk.
• host_permissions: *://octagonfind.com/* low Scoped to own domain only; limited blast radius.
• chrome_settings_overrides.search_provider (is_default=true) high Overrides default search engine to octagonfind.com; high user-impact capability.

Pillar Scores

Bookkeeping