Top Risks

• Extension last updated 55 months ago — effectively abandoned with no security patches.
• Privacy policy (Google Sites) admits data collection and third-party sharing but is not scoped to this extension.
• Default search engine override routes all user queries through privacia.org with no accountability.
• Developer uses free webmail (gmail) with no business website or verified developer identity.
• Startup-page override combined with stale maintenance creates persistent low-trust footprint.

Evidence

• search_provider_override manifest chrome_settings_overrides sets Privacia as default search engine (is_default=true), redirecting all queries.
• stale_extension store Last updated February 2022, 55 months ago — no updates in over 4.5 years.
• privacy_policy_inadequate api Policy on Google Sites: fetched=true, scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 (v3.5 rule D).
• free_webmail_developer store Developer email is elleuch.neil2@gmail.com; no developer name listed; no business domain.
• verified_publisher store verified_publisher=true but discount capped at -1.0 per v3.5 rule E (stale >18mo).
• no_js_files crx js_file_count=0, code_findings_raw empty, obfuscation_score=0.0 — pure manifest extension.
• low_installs store Only 92 installs; rating 3.7 with insufficient count for -0.5 trust discount.
• no_bad_hosts api threat_intel bad_host_hits, monetization_hits, affiliate_hits all empty.

Permissions Breakdown

• *://*.privacia.org/* medium Host permission scoped to dev-owned domain; needed for search-provider integration.
• chrome_settings_overrides.search_provider (is_default=true) high Overrides default search engine for all user queries — high-impact capability.
• chrome_settings_overrides.startup_pages medium Sets browser startup page to privacia.org, altering UX on every launch.

Pillar Scores

Bookkeeping