Top Risks

• Default search engine override routes all searches to dev-controlled myvideolibrary.info — monetization/data-collection risk.
• Uninstall URL hijack and install URL hijack both flagged; classic traffic-monetization shell behavior.
• Free-webmail developer (gmail) with no developer name and no verified business domain.
• Privacy policy fetched but not scoped to this extension, and explicitly admits third-party sharing.
• Verified/Featured badges present but do not override search-override monetization concern per v3.5 invariant 0c/E.

Evidence

• search_provider_override manifest chrome_settings_overrides.search_provider is_default=true pointing to myvideolibrary.info/search.php
• uninstall_url_hijack crx uninstall_url_hijack=true; classic monetization shell fingerprint.
• install_url_hijack crx install_url_hijack=true; opens 3rd-party page on install.
• free_webmail_no_dev_name store developer_email=lyashenko.sptk@gmail.com; developer_name empty; no verified business.
• privacy_policy_not_scoped api scope_extension=false, data_collection=false but third_party_sharing=true; policy not tied to this extension.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; discount applies but capped by search-override HIGH capability (v2 0b).
• no_csp manifest content_security_policy=null; MV3 so no +2.0 MV2 penalty, but no CSP present.
• low_rating store Rating 3.3 with small install base (3000); below-average user satisfaction.

Permissions Breakdown

• storage low Stores local preferences; low impact alone.
• host_permissions: *://myvideolibrary.info/* medium Narrow host scope to dev's own domain; medium risk due to search-provider override pairing.
• chrome_settings_overrides.search_provider (is_default=true) high Overrides default search engine to dev-controlled domain; classic monetization vector.

Pillar Scores

Bookkeeping