Top Risks

• Default search engine override sends all omnibox queries to myfocalfind.com — a monetization-oriented search hijacker pattern.
• Developer is free-webmail (gmail) with no developer name, rated 1-star; strong low-trust signal.
• Uninstall URL hijack present — extension registers a 3rd-party uninstall redirect.
• Privacy policy admits data collection and third-party sharing but is NOT scoped to this extension — generic boilerplate.
• 27 months since last update; extension is effectively abandoned with 30K active users still exposed.

Evidence

• search_provider_override manifest chrome_settings_overrides sets myfocalfind.com as default search with is_default=true; all omnibox queries routed to it.
• uninstall_url_hijack store uninstall_url_hijack=true; extension registers an uninstall URL redirect, a known monetization/tracking pattern.
• developer_identity_weak store Developer email reedd6868@gmail.com (numbered alias + free webmail), no developer name, no verified business domain.
• rating_1_star store Rating is 1.0 — lowest possible score, strongly indicating user dissatisfaction or search-hijack complaints.
• privacy_policy_inadequate api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true — admits broad sharing, not scoped to extension.
• stale_extension store Last updated May 2024, 27 months ago; falls in 24-36mo maintenance band (+8.5).
• verified_publisher_featured store Marked verified_publisher and is_featured_by_google, but v2 cap applies: search override is HIGH capability, discount capped.
• webstore_search_override_monetization manifest Search provider override (+2.0) stacked with uninstall hijack (+3.0) and numbered-alias email (+3.0) in webstore pillar.

Permissions Breakdown

• storage low Standard local storage for extension settings; low risk.
• declarativeNetRequest medium Can intercept/redirect network requests; medium risk but no host wildcard.
• chrome_settings_overrides.search_provider (is_default=true) high Overrides default search engine to myfocalfind.com; hijacks all omnibox searches.
• host_permissions: *://myfocalfind.com/* low Scoped to own domain only; narrow host access.

Pillar Scores

Bookkeeping