Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Easy Search [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search-provider override silently routes all user queries to dev-controlled easy-search.pro domain.
• Uninstall URL hijack detected — extension registers an uninstall callback to a third-party URL.
• Free webmail developer (klichkox@gmail.com), no developer name, no verified publisher status.
• Privacy policy fetched but scope_extension==false and third_party_sharing==true — not scoped to this extension.

Evidence

• search_provider_override manifest chrome_settings_overrides sets easy-search.pro as default search engine (is_default=true), hijacking all queries.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers uninstall URL, typical monetization/tracking shell pattern.
• free_webmail_dev_no_name store Developer email klichkox@gmail.com, no developer_name set, no verified publisher badge.
• privacy_policy_unscoped_third_party_sharing api Policy fetched; scope_extension=false, third_party_sharing=true — admits sharing without scoping to extension.
• search_provider_medium_permission manifest Search override scored as MEDIUM (+1.0) per rubric; combined with no developer identity raises risk.
• no_install_count_no_rating store install_count and rating_count both missing; no popularity or community trust signals available.
• webstore_search_override_signal store +2.0 Webstore for search-provider override; +3.0 for uninstall URL hijack monetization pattern.
• cve_clean_code_clean crx cve_findings_raw empty, code_findings_raw empty, obfuscation_score=0.0 — no code-level risk detected.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Easy Search [browser-hijack] + malext.io malicious_extension_sentry; score 4.05 -> 6.55 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Stores local extension settings; low impact alone.
• chrome_settings_overrides.search_provider (is_default=true) medium Overrides default search engine to easy-search.pro, routing all queries through dev-controlled domain.
• host_permissions: *://easy-search.pro/* medium Scoped to own domain only; needed for search function but still grants full access to that domain.

Pillar Scores

Bookkeeping