Top Risks

• Search-provider override routes queries through cadslist.com tracking URL (/trk/t.php with channel param).
• Extension abandoned for 26 months — stale, unpatched, no active governance.
• Privacy policy not scoped to this extension; admits data collection and third-party sharing.
• Developer uses free-webmail (gmail) with no verified publisher status.
• Featured badge despite search override + stale codebase raises trust-signal concern.

Evidence

• search_provider_override manifest chrome_settings_overrides sets cadslist.com as default search with tracking URL /trk/t.php?q=&channel=CADSLIST
• stale_extension store Last updated June 2024; 26 months since update — high abandonment risk.
• privacy_policy_inadequate api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — generic, not extension-scoped.
• free_webmail_developer store Developer email cadslists@gmail.com; no verified publisher badge; no business domain email.
• featured_badge_present store is_featured_by_google=true, providing partial trust signal despite other risk factors.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0, 11 JS files scanned cleanly.
• no_cve_findings crx jquery 3.7.1 bundled — current, no CVEs found in cve_findings_raw.
• no_bad_hosts api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty.

Permissions Breakdown

• activeTab low Only activates on user-initiated tab; narrow scope.
• scripting medium Can inject scripts into active tab; elevated when paired with activeTab.
• chrome_settings_overrides.search_provider medium Sets cadslist.com as default search engine with tracking channel param.

Pillar Scores

Bookkeeping