Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Microsoft Bing Search with Rewards [browser-hijack] (+2.0, capped).
• FORCE BLOCK: management + broad host access — extension can disable security tools AND has full traffic-routing capability.
• Privacy policy is Google's generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — does not cover this extension's data practices.
• Broad host permissions (http://*/*, https://*/*) combined with cookies and scripting enable full page-content access and cookie exfiltration at scale (3M installs).
• management permission can enumerate and disable all other installed extensions — unusually powerful for a search/rewards extension.

Evidence

• privacy_policy_generic_google store Privacy policy URL is myaccount.google.com; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• broad_host_plus_cookies_scripting manifest http://*/* + https://*/* with cookies+scripting: HIGH×1.2 amplifier applied; justified-broad discount not applicable to rewards/search category.
• management_permission manifest management declared — can disable/enable other extensions; atypical for a search-rewards extension.
• search_provider_override manifest chrome_settings_overrides.search_provider forces Bing as default; is_default=true. Monetization mechanism.
• install_url_hijack crx onInstalled opens /Welcomepage/index.html?xid=106&bmkt= — install URL hijack confirmed.
• cve_jquery_xss crx jquery@3.4.1 has CVE-2020-11022 and CVE-2020-11023 (moderate XSS); fixed_in 3.5.0; no CSP present.
• no_csp_mv3 manifest content_security_policy is null; MV3 so no +2.0 network penalty, but CVE×1.5 amplifier applies for jquery DOM-sink combo.
• recognized_org_microsoft store developer_name=Microsoft Corporation, domain resolves, not throwaway; reputation base reduced. capability gate: broad host+cookies limits discount.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Microsoft Bing Search with Rewards [browser-hijack]; score 4.67 -> 6.67 (+2.0 cap 2.5).

CVE Exposures (2)

Permissions Breakdown

• cookies high Full cookie read/write across all origins via broad host permissions.
• management high Can enumerate and disable other installed extensions.
• notifications medium Can push notifications to user; used for rewards prompts.
• alarms low Periodic background execution; low standalone risk.
• storage low Local data persistence; low standalone risk.
• scripting high Programmatic script injection into pages; combined with <all_urls> host permissions.
• declarativeNetRequest medium Can modify network requests declaratively; used for search redirect.
• http://*/* high Broad host access to all HTTP sites.
• https://*/* high Broad host access to all HTTPS sites.
• chrome_settings_overrides.search_provider medium Forces Bing as default search provider; explicit monetization mechanism.

Pillar Scores

Bookkeeping