Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Earth Search for Chrome [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Gmail developer 'Watch TV' with numbered alias (watchtvapp572) — classic low-accountability operator pattern.
• Search provider override sets is_default=true, hijacking all user queries to extension-controlled domain.
• Uninstall URL hijack confirmed — extension tracks removal events via 3rd-party redirect.
• Install URL hijack opens earthsearchforchrome.com on install, enabling immediate fingerprinting.

Evidence

• search_provider_override manifest chrome_settings_overrides sets earthsearchforchrome.com as default search engine (is_default=true).
• uninstall_url_hijack crx uninstall_url_hijack=true; target not resolved but runtime call confirmed in extension.
• install_url_hijack crx install_url_target=https://earthsearchforchrome.com/extension-success/ — opens on install.
• gmail_numbered_alias_dev store Developer email watchtvapp572@gmail.com is a numbered free-webmail alias; no verifiable business identity.
• low_rating store Rating 1.0 — consistent with user complaints about unwanted search provider replacement.
• developer_name_mismatch store Developer name 'Watch TV' is unrelated to a search extension — category/identity mismatch.
• privacy_policy_adequate api Privacy policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• no_csp manifest content_security_policy is null; MV3 strict-default applies so no additional network penalty scored.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Earth Search for Chrome [browser-hijack] + malext.io malicious_extension_sentry; score 5.29 -> 7.79 (+2.5 cap 2.5).

Permissions Breakdown

• chrome_settings_overrides.search_provider (is_default=true) medium Replaces default search engine with extension-controlled endpoint, redirecting all queries.
• uninstall_url_hijack medium Sets uninstall URL to 3rd-party; tracks uninstall events and drives re-acquisition.
• install_url_hijack medium Opens earthsearchforchrome.com on install; confirms install and may start tracking.

Pillar Scores

Bookkeeping