Top Risks

• Default search engine override redirects all user queries to breeezyapps.com — persistent query interception at scale.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing (Privacy pillar = 10).
• No developer name listed; unverified publisher reduces accountability.
• 100,000 installs amplifies blast radius of search hijack monetization.
• Extension has zero JS files — functionality is entirely in search override; opaque operation with no auditable code.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider sets is_default=true, routing all searches to search.breeezyapps.com.
• privacy_policy_generic store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_developer_name store developer_name is empty string; no 'Offered by' identity; reduces accountability.
• no_js_files crx js_file_count=0, js_files_scanned=0; extension is pure search-override manifest with no auditable JS.
• install_count_blast_radius store 100,000 installs; search override affects all user queries at this scale.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; no trust badges.
• search_override_monetization manifest Search URL points to search.breeezyapps.com — unknown monetization/ad-tech backend behind proxy search.
• cve_findings_empty crx No CVEs found; no JS libraries bundled.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Hijacks user's default search engine to breeezyapps.com; MEDIUM per rubric, core risk of this extension.

Pillar Scores

Bookkeeping