Top Risks

• Default search-engine override routes all omnibox queries to eabsearch.com — persistent query surveillance.
• Uninstall URL hijack to eabsearch.com signals monetization-shell pattern.
• Install URL hijack on onInstalled event further confirms traffic-monetization intent.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst-case disclosure.
• Extension is 27 months stale with 40K installs and no CSP — abandoned but high-reach.

Evidence

• search_provider_override manifest chrome_settings_overrides sets eabsearch.com as default search with is_default:true, capturing all user queries.
• uninstall_url_hijack crx uninstall_url_target=https://eabsearch.com/uninstall-completed — classic traffic-monetization signal.
• install_url_hijack crx install_url_hijack=true; onInstalled opens third-party URL.
• privacy_policy_generic store Policy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• stale_extension store Last updated May 2024; 27 months since update with 40K installs — zombie reach.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• search_provider_medium_permission manifest Search-provider override scored as MEDIUM+1.0 per rubric, stacked with is_default penalty.
• reputation_unverified store No verified publisher badge, not featured by Google; developer 'IM doo' has no recognized org status.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local preference storage; low risk.
• chrome_settings_overrides.search_provider (is_default:true) high Forces eabsearch.com as default search engine, redirecting all omnibox queries.
• host_permissions: https://eabsearch.com/ medium Scoped to developer-owned search domain; enables data sends to that host.

Pillar Scores

Bookkeeping