Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Surfer Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search hijack routes all queries through oasrchrdr.com with tracking ID (PCSF/dgd params) — clear monetization redirect.
• Uninstall URL hijack active; developer tracks when users remove the extension.
• Privacy policy fetched but not scoped to this extension; admits data collection and third-party sharing — worst-case disclosure.
• Free-webmail developer (gmail) with no developer name or verified publisher badge — no accountability.

Evidence

• search_provider_override manifest is_default=true; search_url routes to oasrchrdr.com?dgd=RD1005461&PCSF=true — monetization tracker params present.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() invoked; target not disclosed but hijack confirmed by scan.
• privacy_policy_inadequate api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — generic, not extension-scoped.
• free_webmail_no_devname store developer_email=surfersearchext@gmail.com; developer_name empty; no verified publisher badge.
• webrequest_on_redirector manifest webRequest declared with host_permission covering oasrchrdr.com — can observe all search traffic.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; 2000 installs with HIGH-tier permissions.
• external_js_host crx js_external_hosts includes www.surfertoday.com — third-party JS load outside stated search function.
• maintenance_stale store months_since_update=13; falls in 12-24mo band (+6.0 maintenance score).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Surfer Search [browser-hijack] + malext.io malicious_extension_sentry; score 6.51 -> 9.01 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local key-value storage only; low direct harm potential.
• webRequest high Can observe all network requests matching host_permissions; surveillance surface.
• chrome_settings_overrides.search_provider (is_default=true) high Silently redirects all user searches through oasrchrdr.com — core monetization vector.
• host_permissions: https://*.surfersearch.com/* medium Scoped to own domain; needed for suggest URL and uninstall redirect.
• host_permissions: https://*.oasrchrdr.com/* high Third-party search redirector domain; all searches routed here with tracking params.

Pillar Scores

Bookkeeping