Top Risks

• Default search engine override routes all queries to searchlotto.co.uk — monetization surface with no dev identity.
• Privacy policy is Google's own account policy — not scoped to this extension; data_collection and third_party_sharing both true.
• No developer name, email, or verified publisher badge; zero accountability for the search redirect.
• months_since_update unknown; maintenance posture cannot be assessed — treated as stale.
• No title, installs, or rating data available — blind-spot on reach and user sentiment.

Evidence

• search_provider_override manifest chrome_settings_overrides sets searchlotto.co.uk as default search engine with is_default:true.
• generic_privacy_policy store Policy URL is Google account policy (myaccount.google.com) — scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_identity store developer_name, developer_email, and verified_publisher all missing/false — no accountability.
• maintenance_unknown api months_since_update is null; last_updated missing. Cannot confirm extension is actively maintained.
• js_external_host crx Single external JS host: www.searchlotto.co.uk. No bad-host or monetization hits in threat_intel.
• no_csp manifest content_security_policy is null; csp_present=false. MV3 default applies but no explicit CSP declared.
• no_installs_or_rating store installs and rating fields empty — blast radius and user trust signals unavailable.
• cve_findings_empty crx No CVEs detected in bundled libraries; no bad-host hits in threat_intel.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default:true) medium Forces searchlotto.co.uk as default search engine, redirecting all user queries to third-party.

Pillar Scores

Bookkeeping