Top Risks

• Default search engine hijacked to arcadegamesfreeapp.com — all queries routed to dev-controlled server.
• Uninstall URL hijack set; install URL opens arcadegamesfreeapp.com/extension-success/ tracking users.
• Free-webmail developer (gmail), no developer name — unaccountable identity.
• Rating 1.7 signals user dissatisfaction consistent with unwanted search-override behavior.
• Privacy policy admits data collection and third-party sharing without retention disclosure.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true routing all searches to arcadegamesfreeapp.com.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers custom uninstall URL with Chrome.
• install_url_hijack crx install_url_hijack=true; onInstalled opens https://arcadegamesfreeapp.com/extension-success/.
• low_rating store Rating 1.7 — well below threshold, consistent with unwanted search override complaints.
• free_webmail_dev_no_name store Developer email copelandn471@gmail.com; developer_name empty — unverifiable identity.
• privacy_policy_third_party_sharing api Policy scoped to extension, admits data collection + third-party sharing; no retention clause.
• cookies_permission manifest cookies permission with host access to dev domain enables session/query tracking.
• no_csp manifest content_security_policy is null; csp_present=false for MV3 extension.

Permissions Breakdown

• storage low Standard local data storage, low direct harm potential.
• cookies high Can read/write cookies; paired with host_permissions enables session tracking.
• host_permissions: https://arcadegamesfreeapp.com/* medium Scoped to dev domain but enables cookie access on that domain.
• chrome_settings_overrides.search_provider (is_default=true) high Overrides default search engine to dev-controlled endpoint — monetization vector.

Pillar Scores

Bookkeeping