Top Risks

• Privacy policy URL returns connection error — effectively no accessible policy for a search-data-collecting extension.
• Developer uses free Gmail address with no business name; domain cannot be verified via CT logs.
• Extension last updated 34 months ago — zombie-level staleness with 238 live installs.
• Search provider override routes all user queries to unverified premiersearches.com domain.
• Verified-publisher and featured discounts capped at -1.0 (v3.5/0c): stale >18mo + unreachable dev domain.

Evidence

• search_provider_override manifest chrome_settings_overrides sets premiersearches.com as default search, capturing all user search queries.
• privacy_policy_fetch_failed api privacy_policy_classification.fetched=false due to ConnectionError; policy is inaccessible, scored +10.0 privacy.
• free_webmail_dev store Developer email premiersearch1@gmail.com; no developer name listed; brand_mention.developer_domain=gmail.com.
• zombie_staleness store 34 months since last update (Oct 2023); maintenance pillar scored 8.5 + zombie booster not triggered (<10K installs).
• verified_publisher_capped store Verified+featured discounts capped at -1.0 per v3.5/0c: months_since_update=34 >18mo and dev domain unreachable.
• no_js_files crx js_file_count=0, code_findings_raw empty, obfuscation_score=0.0; code quality risk is nil.
• low_install_count store Only 238 installs; blast radius limited but tail_attack_surface=false per anomaly check.
• no_bad_hosts_or_cves api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty; cve_findings_raw empty.

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Sets premiersearches.com as default search engine, redirecting all search queries to an unverified domain.
• host_permissions: https://premiersearches.com/* low Scoped to own domain only; narrow but paired with search override concentrates data flow.

Pillar Scores

Bookkeeping