Top Risks

• Default search engine override routes all user queries to search.com with UTM tracking parameters.
• Privacy policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — admits broad sharing without scoping to this extension.
• install_url_hijack opens search.com/thank-you-extension on install — unsolicited redirect to operator site.
• Developer name is generic 'developers'; no verified publisher badge; low trust signal.
• Extension titled 'SearchGPT' with no AI capability — possible brand lure on OpenAI/ChatGPT name recognition.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Search.com as default engine with UTM tracking; is_default=true.
• install_url_hijack crx onInstalled opens https://search.com/thank-you-extension — unsolicited 3rd-party redirect.
• privacy_policy_inadequate api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true, retention=false.
• unverified_developer store Developer name 'developers'; no verified publisher badge; no featured badge.
• brand_name_mismatch store Extension named 'SearchGPT' but sets Search.com as default search, no GPT/AI functionality declared.
• low_install_count store Only 87 installs; rating=5 with unknown rating count — unreliable social proof.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• webNavigation_permission manifest webNavigation grants full navigation event visibility enabling browsing pattern monitoring.

Permissions Breakdown

• storage low Stores local settings; low-impact, no user-data exfil risk alone.
• webNavigation medium Observes all navigation events; enables tracking of browsing patterns.
• chrome_settings_overrides.search_provider (is_default: true) medium Silently sets Search.com as default search engine; redirects all queries to operator.

Pillar Scores

Bookkeeping