Top Risks

• Search provider and startup page hijacked to sosearcher.com — all user queries routed to developer-controlled site
• Uninstall and install URL hijack flags set; extension manipulates browser lifecycle events
• Developer is anonymous (no name, free Gmail), privacy policy unreachable (fetch timeout) — no accountability
• Extension is over 36 months stale with 40K installs; zombie risk — abandoned or ripe for sale/compromise
• Privacy policy fetch failed; treated as no policy — data handling completely unknown

Evidence

• search_provider_override manifest chrome_settings_overrides sets sosearcher.com as default search and startup page with is_default=true.
• uninstall_url_hijack store uninstall_url_hijack=true; extension registers an uninstall URL redirect to 3rd-party destination.
• install_url_hijack store install_url_hijack=true; extension opens a URL on install — likely affiliate/monetization landing page.
• privacy_policy_unreachable api Privacy policy fetch failed with ReadTimeout; scored as no policy (+10.0 privacy pillar).
• developer_identity store No developer name; email is free Gmail (down4me.extensions@gmail.com); not verified publisher.
• stale_zombie store 37 months since last update with 40K installs; zombie booster applies (>36mo + >10K installs).
• triple_stale_fingerprint store v2 calibration: >24mo stale + MV3 (no CVEs, no MV2 penalty, but stale+monetization-shell pattern).
• numbered_alias_email store Developer email 'down4me.extensions@gmail.com' matches numbered/alias pattern (+3.0 webstore).

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Overrides default search engine to sosearcher.com; core monetization mechanism for this extension.
• chrome_settings_overrides.startup_pages medium Sets browser startup page to sosearcher.com; forces traffic to developer-controlled domain.

Pillar Scores

Bookkeeping