Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Get Maps & Driving Directions [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Search-provider override (is_default=true) to bestfreemaps.com — classic search hijack.
• Uninstall and install URL hijacks both present — persistent monetisation hooks.
• Privacy policy URL returns HTTP error (fetch_error); treated as no policy.
• External JS hosts (m.mapsr.com, my-directions.com) loaded by MV3 extension with no CSP.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to bestfreemaps.com/search-direction.php — search hijack.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true. Both redirect hooks present.
• external_js_hosts crx JS loaded from m.mapsr.com and my-directions.com; no CSP to constrain these sources.
• privacy_policy_unfetchable api Privacy policy URL returns HTTPError; classified as fetched=false → +10.0 privacy pillar.
• search_provider_medium_permission manifest chrome_settings_overrides scored as MEDIUM permission per v2 calibration rule (a).
• maintenance_stale store 16 months since update → +6.0 maintenance; v3.5 cap-0c: monetization domain triggers -1.0 cap on any discount.
• developer_mismatch store Developer branded QwerPDF publishing a maps extension; domain mismatches product — shell pattern signal.
• no_csp manifest content_security_policy is null; MV3 strict default applies but external JS hosts still load.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Get Maps & Driving Directions [browser-hijack] + malext.io malicious_extension_sentry; score 6.53 -> 9.03 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local key-value storage only; no cross-site data access.
• chrome_settings_overrides.search_provider (is_default=true) high Silently replaces default search engine with bestfreemaps.com — classic hijack vector.

Pillar Scores

Bookkeeping