Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — MyShopSearch [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all queries to myshopsearch.com with publisher tracking param (pub=3200).
• Developer email is free Gmail; no verified publisher badge; limited developer accountability.
• Extension not updated in 61 months — completely abandoned, unpatched against future browser changes.
• Privacy policy not scoped to this extension; third-party sharing treatment is silent.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to myshopsearch.com/results.php?pub=3200&v=400 — publisher tracking param present.
• stale_extension store Last updated July 2, 2021; 61 months since update — deeply stale, no active maintenance.
• free_webmail_dev store Developer email myshopsearch.ltd@gmail.com is free Gmail; no verified publisher badge.
• privacy_policy_inadequate api Policy fetched (112KB) but scope_extension=false, data_collection=false — not scoped to this extension.
• third_party_silence api Privacy policy silent on third-party data sharing; +1.0 privacy penalty applied.
• featured_by_google store is_featured_by_google=true; partial trust discount applied to reputation pillar.
• no_cve_no_bad_hosts api cve_findings_raw and bad_host_hits both empty; no CVE or threat-intel risk.
• webstore_search_override manifest Search-provider override scored +2.0 in Webstore; staleness >24mo adds triple-stale but no CVEs so partial.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — MyShopSearch [browser-hijack] + malext.io malicious_extension_sentry; score 5.97 -> 8.47 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Overrides default search engine; monetization-oriented redirect to myshopsearch.com with pub param.

Pillar Scores

Bookkeeping