Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cubbie [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search provider override routes all searches through developer-controlled getcubbie-api.com with no verified publisher accountability.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension — scores maximum privacy risk.
• Uninstall URL hijack present; extension redirects on removal to an unspecified third-party endpoint.
• Bundled jquery@3.3.1 carries 3 medium-severity CVEs (CVE-2019-11358, CVE-2020-11022, CVE-2020-11023); no CSP amplifies XSS risk.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to search.getcubbie-api.com; all user searches monetized through dev-controlled domain.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() present; uninstall_url_target null but hijack confirmed — redirects users on removal.
• privacy_policy_generic store Policy fetched (268KB), scope_extension=false, data_collection=true, third_party_sharing=true — admits sharing but not scoped to extension.
• free_webmail_developer store Developer email cubbiesearch@gmail.com; no verified publisher badge; domain_age_ct not queried due to free webmail.
• cve_jquery_medium_x3 crx jquery@3.3.1 bundles CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; all fixed in 3.5.0; no CSP present to mitigate.
• no_csp manifest content_security_policy is null; combined with vulnerable jQuery and DOM-manipulation risk raises code quality score.
• cookies_permission_with_search_override manifest cookies permission paired with search provider override enables tracking of all search activity and session state.
• js_external_hosts crx Extension contacts api., events.misc.services, search., uninstall. subdomains — 4 distinct functional endpoints under getcubbie-api.com.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cubbie [browser-hijack] + malext.io malicious_extension_sentry; score 6.37 -> 8.87 (+2.5 cap 2.5).

CVE Exposures (3)

Permissions Breakdown

• cookies high Can read/write cookies across visited sites; combined with search-provider override significantly elevates risk.
• storage low Local extension storage; low standalone risk.
• tabs medium Can read tab URLs and titles; moderate surveillance capability.
• declarativeNetRequest medium Can block/redirect network requests; paired with search override raises concern.
• webNavigation medium Can observe all navigation events including URLs visited.
• alarms low Scheduling only; minimal standalone risk.
• chrome_settings_overrides.search_provider high Replaces default search engine with developer-controlled endpoint; core monetization vector.
• host_permissions: *://*.getcubbie-api.com/* medium Scoped to developer domain; limits blast radius but all traffic routed there.

Pillar Scores

Bookkeeping