Top Risks

• Default search engine hijack routes all user queries to bestfreemaps.com/search-earth.php.
• Both install and uninstall URL hijacks active — redirect behavior on install and removal.
• Privacy policy admits data collection and third-party sharing without retention disclosure.
• Low rating (2.6) and 16-month stale update raise abandonment and trust concerns.
• External JS host (earth3dmaps.com) differs from developer domain, expanding attack surface.

Evidence

• search_provider_override manifest chrome_settings_overrides sets is_default=true, routing searches to https://bestfreemaps.com/search-earth.php
• uninstall_url_hijack crx uninstall_url_hijack=true; fires on extension removal.
• install_url_hijack crx install_url_hijack=true; opens 3rd-party URL on install.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• external_js_host crx JS loads from earth3dmaps.com — separate domain from developer domain bestfreemaps.com.
• low_rating store Rating 2.6 — below acceptable threshold, suggesting user dissatisfaction.
• stale_extension store Last updated April 2025; 16 months since update — 12-24mo band (+6.0 maintenance).
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.

Permissions Breakdown

• storage low Stores local extension data; minimal risk on its own.
• chrome_settings_overrides.search_provider (is_default=true) high Forces default search engine to bestfreemaps.com, redirecting all searches to dev-controlled site.

Pillar Scores

Bookkeeping