Top Risks

• Google brand impersonation: uses Google name/logo in description without being affiliated; is_impersonation=true.
• Privacy policy points to Google's own policy (myaccount.google.com) — not scoped to this extension; data collection and 3rd-party sharing admitted without extension-specific context.
• Install URL hijack: onInstalled opens https://mysearcheasy.com/sucess.htm on a third-party domain.
• Startup-page override to mysearcheasy.com — redirects every new browser session to developer-controlled site.
• Stale 15 months with only 7 installs; no verifiable publisher, no ratings, no transparency.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; mentions Google but confirmed_owner=false; not verified publisher.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• install_url_hijack manifest install_url_hijack=true; target=https://mysearcheasy.com/sucess.htm — opens 3rd-party URL on install.
• startup_page_override manifest chrome_settings_overrides.startup_pages=[https://mysearcheasy.com/start]; redirects browser startup.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false, only 7 installs, rating=0.
• stale_extension store months_since_update=15; falls in 12-24mo band → Maintenance +6.0.
• description_promise_mismatch store Description in Japanese claims Google search; no matching permissions declared beyond startup override.
• host_geo api JS host in BR only; country_count=1; no geo-diversity risk applied.

Permissions Breakdown

• chrome_settings_overrides.startup_pages medium Sets browser startup page to mysearcheasy.com; hijacks default browsing entry point.

Pillar Scores

Bookkeeping