Top Risks

• Search-provider override silently redirects all queries to fastsearchsafe.com via a gmail-registered developer.
• Developer uses free webmail (gmail) with no verified business identity — unattributable operator.
• Privacy policy admits data collection and third-party sharing but retention period undisclosed.
• Extension name/domain mismatch (fastsafesearch.com vs fastsearchsafe.com) raises credibility concern.
• No JS, no manifest description, no chrome_url_overrides — bare search-hijack shell with minimal transparency.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true routing all searches to search.fastsearchsafe.com.
• free_webmail_developer store Developer email jacoblee2285@gmail.com; no verified business domain; gmail-tier identity only.
• domain_mismatch store Privacy policy on fastsafesearch.com; search URLs on fastsearchsafe.com — two unrelated domains.
• privacy_policy_third_party_sharing api Policy fetched: scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• no_js_files crx js_file_count=0, code_findings empty, obfuscation_score=0 — bare manifest shell with only search override.
• maintenance_stale store months_since_update=9 (3-6mo band applied conservatively at 6-12mo boundary → +3.5).
• webstore_search_override_medium store chrome_settings_overrides.search_provider scored per v2.1 rule (a) even with empty permissions[].
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no trust anchors present.

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Silently replaces the user's default search engine; high-value for traffic monetization.

Pillar Scores

Bookkeeping