Top Risks

• Search provider override sets colourcure.xyz as default engine with is_default:true — all queries monetized.
• Uninstall and install URL hijacks both confirmed — aggressive retention/acquisition behavior.
• 40 months since last update — zombie extension, high acquisition/compromise risk.
• Privacy policy is 58-char stub (scope_extension:false, data_collection:false) — effectively inadequate.
• Free-webmail developer (gmail.com), no developer name, no verified business identity.

Evidence

• search_provider_override manifest chrome_settings_overrides sets colourcure.xyz as default search with is_default:true; all queries routed.
• uninstall_url_hijack crx uninstall_url_hijack=true; aggressive post-uninstall tracking or re-install prompting.
• install_url_hijack crx install_url_hijack=true; opens 3rd-party URL on install.
• stale_extension store Last updated April 2023 (40 months ago); zombie-level staleness increases takeover/compromise risk.
• inadequate_privacy_policy api Policy fetched but only 58 chars; scope_extension=false, no retention/collection disclosure.
• free_webmail_no_dev_name store Developer email annelaurent.dev@gmail.com; developer_name empty; no verified business identity.
• verified_publisher store Verified publisher badge present; partial reputation credit, capped due to staleness (>18mo).
• no_csp manifest content_security_policy is null for MV3 extension; no explicit CSP declared.

Permissions Breakdown

• storage low Local data persistence only; no cross-site or user-data exfil risk.
• chrome_settings_overrides.search_provider medium Overrides default search engine to colourcure.xyz; is_default:true monetizes all queries.

Pillar Scores

Bookkeeping