Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Bing Search Microsoft Rewards [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all queries to smartwebfinder.com — likely ad-monetized search hijack.
• Privacy policy is Google's generic account policy, not scoped to this extension; data handling undisclosed.
• No developer identity: no name, no email, no verified publisher — zero accountability.
• Extension title and description use unresolved i18n placeholders — deliberate obfuscation of purpose.

Evidence

• search_provider_override manifest chrome_settings_overrides sets smartwebfinder.com as default search, is_default=true.
• no_developer_identity store developer_name, developer_email, and title are all empty — no accountability surface.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• i18n_placeholder_names manifest manifest_name='__MSG_appName__', manifest_description='__MSG_appDesc__' — purpose hidden from store scan.
• zero_js_files crx js_file_count=0; extension has no JS surface yet still modifies browser search behaviour.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false — no trust signals present.
• maintenance_unknown api months_since_update=null; update date unavailable — staleness cannot be ruled out.
• no_bad_hosts_or_cves crx threat_intel bad_host_hits empty, cve_findings_raw empty — no active malware signals detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Bing Search Microsoft Rewards [browser-hijack] + malext.io malicious_extension_sentry; score 2.66 -> 5.16 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider medium Sets smartwebfinder.com as default search engine — classic search-hijack pattern.

Pillar Scores

Bookkeeping